CVE-2023-38500 - Vulnerability Details - OpenCVE

TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Typo3	Html Sanitizer

Configuration 1 [-]

OR	cpe:2.3:a:typo3:html_sanitizer::::::::
	cpe:2.3:a:typo3:html_sanitizer::::::::

No data.

References

Link	Providers
https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb
https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g
https://typo3.org/security/advisory/typo3-core-sa-2023-002

History

Fri, 11 Oct 2024 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-07-25T20:59:53.135Z

Updated: 2024-10-10T17:36:20.315Z

Reserved: 2023-07-18T16:28:12.077Z

Link: CVE-2023-38500

Vulnrichment

Updated: 2024-08-02T17:46:55.962Z

NVD

Status : Modified

Published: 2023-07-25T21:15:11.083

Modified: 2024-11-21T08:13:42.270

Link: CVE-2023-38500

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38500", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-07-18T16:28:12.077Z", "datePublished": "2023-07-25T20:59:53.135Z", "dateUpdated": "2024-10-10T17:36:20.315Z"}, "containers": {"cna": {"title": "By-passing Cross-Site Scripting Protection in HTML Sanitizer", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"name": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb", "tags": ["x_refsource_MISC"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2023-002", "tags": ["x_refsource_MISC"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}], "affected": [{"vendor": "TYPO3", "product": "html-sanitizer", "versions": [{"version": ">= 1.0.0, < 1.5.1", "status": "affected"}, {"version": ">= 2.0.0, < 2.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-07-25T20:59:53.135Z"}, "descriptions": [{"lang": "en", "value": "TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem."}], "source": {"advisory": "GHSA-59jf-3q9v-rh6g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:46:55.962Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"name": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2023-002", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-10T16:24:38.252139Z", "id": "CVE-2023-38500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-10T17:36:20.315Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38500", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-07-18T16:28:12.077Z", "datePublished": "2023-07-25T20:59:53.135Z", "dateUpdated": "2024-10-10T17:36:20.315Z"}, "containers": {"cna": {"title": "By-passing Cross-Site Scripting Protection in HTML Sanitizer", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"name": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb", "tags": ["x_refsource_MISC"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2023-002", "tags": ["x_refsource_MISC"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}], "affected": [{"vendor": "TYPO3", "product": "html-sanitizer", "versions": [{"version": ">= 1.0.0, < 1.5.1", "status": "affected"}, {"version": ">= 2.0.0, < 2.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-07-25T20:59:53.135Z"}, "descriptions": [{"lang": "en", "value": "TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem."}], "source": {"advisory": "GHSA-59jf-3q9v-rh6g", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:46:55.962Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"name": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"name": "https://typo3.org/security/advisory/typo3-core-sa-2023-002", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-10T16:24:38.252139Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-10T17:32:38.620Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*", "matchCriteriaId": "694BBC2E-09A9-4001-8B3E-DCDEEDDCA867", "versionEndExcluding": "1.5.1", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*", "matchCriteriaId": "75A963C2-ABB8-4AFC-A699-D47FEA291B67", "versionEndExcluding": "2.1.2", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem."}], "id": "CVE-2023-38500", "lastModified": "2024-11-21T08:13:42.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-25T21:15:11.083", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://typo3.org/security/advisory/typo3-core-sa-2023-002"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}