CVE-2023-3978

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3978

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

T

ext nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

References
Link Resource
https://go.dev/cl/514896 Patch
https://go.dev/issue/61615 Issue Tracking Patch Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1988 Issue Tracking Patch Vendor Advisory
https://go.dev/cl/514896 Patch
https://go.dev/issue/61615 Issue Tracking Patch Vendor Advisory
https://pkg.go.dev/vuln/GO-2023-1988 Issue Tracking Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*
History

21 Nov 2024, 08:18

Type Values Removed Values Added
References () https://go.dev/cl/514896 - Patch () https://go.dev/cl/514896 - Patch
References () https://go.dev/issue/61615 - Issue Tracking, Patch, Vendor Advisory () https://go.dev/issue/61615 - Issue Tracking, Patch, Vendor Advisory
References () https://pkg.go.dev/vuln/GO-2023-1988 - Issue Tracking, Patch, Vendor Advisory () https://pkg.go.dev/vuln/GO-2023-1988 - Issue Tracking, Patch, Vendor Advisory
Information

Published : 2023-08-02 20:15

Updated : 2024-11-21 08:18

NVD link : CVE-2023-3978

Mitre link : CVE-2023-3978

CVE.ORG link : CVE-2023-3978

JSON object : View

Products Affected

golang

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')