Improper handling of special tags within script contexts in html/template
CVE-2023-39319

6.1MEDIUM

Key Information:

Vendor

Go Standard Library

Status
Html/template
Vendor
CVE Published:
8 September 2023

What is CVE-2023-39319?

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

Affected Version(s)

html/template 0 < 1.20.8

html/template 1.21.0-0 < 1.21.1

References

https://go.dev/issue/62197
https://go.dev/cl/526157
https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.)
.
CVE-2023-39319 : Improper handling of special tags within script contexts in html/template