CVE-2024-22199

CVSS V2 None CVSS V3 None
Description
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.
Overview
  • CVE ID
  • CVE-2024-22199
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-01-11T17:39:45.745Z
  • Last Modified Date
  • 2024-01-11T17:39:45.745Z
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CWE-116 http://cwe.mitre.org/data/definitions/116.html
References
Reference URL Reference Tags
https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6 x_refsource_CONFIRM
https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-22199
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22199
History
Created Old Value New Value Data Type Notes
2024-06-26 09:20:43 Added to TrackCVE