CVE-2021-23980

Katalog CVE

CVSS 6.1 · Medium EPSS 0,48%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada mozilla bleach. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.

Rincian

Terbit di NVD

16 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mozilla/bleach/security/advisories/GHSA-vv2x-vrpj-qqpq advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-23980 exploit · issue tracking