Django Template Engine Vulnerable to XSS
CVE-2024-22199

9.3CRITICAL

Key Information:

Vendor

gofiber

Status
template
Vendor
CVE Published:
11 January 2024

What is CVE-2024-22199?

A vulnerability in the Fiber web framework's template engine allows for the potential execution of malicious scripts within users' browsers when they visit affected web pages. This issue arises from the way the template engine handles user-supplied data, leading to cross-site scripting (XSS) attacks. The vulnerability has been addressed by ensuring that the template engine defaults to autoescape set to true, significantly reducing the risk of such attacks in web applications that utilize this framework.

Affected Version(s)

template < 3.1.9

References

https://github.com/gofiber/template/security/advisories/G...
x_refsource_CONFIRM
https://github.com/gofiber/template/commit/28cff3ac4d4c11...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.