CVE-2023-29400

CVSS V2 None CVSS V3 None

Description

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Overview

CVE ID
CVE-2023-29400

Assigner
security@golang.org

Vulnerability Status
Received

Published Version
2023-05-11T16:15:09

Last Modified Date
2023-05-11T16:15:09

Weakness Enumerations

CWE	URL
CWE-74	http://cwe.mitre.org/data/definitions/74.html

References

Reference URL	Reference Tags
https://go.dev/cl/491617
https://go.dev/issue/59722
https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
https://pkg.go.dev/vuln/GO-2023-1753

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-29400
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29400

History

Created	Old Value	New Value	Data Type	Notes
2023-05-11 17:00:55				Added to TrackCVE
2023-05-11 17:01:00			Weakness Enumeration	new