XSS Vulnerability in OWASP JSON Sanitizer
CVE-2020-13973

6.1MEDIUM

Key Information:

Vendor

Owasp

Status
Json-sanitizer
Vendor
CVE Published:
9 June 2020

What is CVE-2020-13973?

The OWASP JSON Sanitizer prior to version 1.2.1 is susceptible to Cross-Site Scripting (XSS) attacks. An attacker can exploit this vulnerability by manipulating input JSON, allowing them to insert malicious scripts into web pages. By controlling segments of the input JSON and placing those segments adjacent to a SCRIPT element, the attacker could deceive the HTML parser regarding the termination of the SCRIPT element, leading to the execution of unintended JavaScript code. This vulnerability poses a significant risk to the integrity of web applications utilizing this library for sanitizing JSON input.

References

https://github.com/OWASP/json-sanitizer/pull/20
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.