CVE Vulnerability

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109 Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html Mailing List Third Party Advisory
https://usn.ubuntu.com/3841-2/ Third Party Advisory
https://usn.ubuntu.com/3841-1/ Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html
Configurations

Configuration 1

cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Information

Published : 2018-12-02 10:29

Updated : 2020-11-26 09:15

NVD link : CVE-2018-19787

Mitre link : CVE-2018-19787

Products Affected
No products.
CWE
CWE-79