CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
Configurations

Configuration 1 (hide)

cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

History

21 Nov 2024, 03:58

Type Values Removed Values Added
References () https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109 - Patch, Vendor Advisory () https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109 - Patch, Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html - () https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html -
References () https://usn.ubuntu.com/3841-1/ - Third Party Advisory () https://usn.ubuntu.com/3841-1/ - Third Party Advisory
References () https://usn.ubuntu.com/3841-2/ - Third Party Advisory () https://usn.ubuntu.com/3841-2/ - Third Party Advisory

Information

Published : 2018-12-02 10:29

Updated : 2024-11-21 03:58


NVD link : CVE-2018-19787

Mitre link : CVE-2018-19787

CVE.ORG link : CVE-2018-19787


JSON object : View

Products Affected

lxml

  • lxml

debian

  • debian_linux

canonical

  • ubuntu_linux
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')