Back to feed
EUVD-2021-0205 · Published Oct 19, 2021
Policies not properly enforced in bluemonday
The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Technologies
Microco BluemondayPython PybluemondayMicrocosm-Cc BluemondayPybluemonday Pybluemonday
Weaknesses
NVD-CWE-OtherCWE-20
CVSS scores
- v3.19.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
- https://nvd.nist.gov/vuln/detail/CVE-2021-42576
- https://github.com/microcosm-cc/bluemonday/commit/c788a2a4d42e081ad54a31368478820bb4a42fb4
- https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50
- https://github.com/advisories/GHSA-x95h-979x-cf3j
- https://github.com/microcosm-cc/bluemonday
Potentially impacted assets
See if this affects your attack surface
