CVE-2021-28957

CVSS V2 Medium 4.3 CVSS V3 Medium 6.1
Description
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Overview
  • CVE ID
  • CVE-2021-28957
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2021-03-21T05:15:13
  • Last Modified Date
  • 2022-12-09T18:15:50
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* 1 OR 4.6.3
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • REQUIRED
  • Scope
  • CHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 6.1
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.8
  • Impact Score
  • 2.7
References
Reference URL Reference Tags
https://bugs.launchpad.net/lxml/+bug/1888153 Exploit Issue Tracking Third Party Advisory
https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999 Patch Third Party Advisory
https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270 Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202208-06
https://security.netapp.com/advisory/ntap-20210521-0004/ Third Party Advisory
https://www.debian.org/security/2021/dsa-4880 Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html Patch Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2021-28957
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28957
History
Created Old Value New Value Data Type Notes
2022-05-10 06:42:52 Added to TrackCVE
2022-12-06 00:07:49 2021-03-21T05:15Z 2021-03-21T05:15:13 CVE Published Date updated
2022-12-06 00:07:49 2022-08-10T20:15:19 CVE Modified Date updated
2022-12-06 00:07:49 Undergoing Analysis Vulnerability Status updated
2022-12-06 00:07:54 References updated
2022-12-09 19:13:15 2022-12-09T18:15:50 CVE Modified Date updated
2022-12-09 19:13:15 Undergoing Analysis Analyzed Vulnerability Status updated