medium6.1

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module.

Impact

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Affected products

Vendor	Product	Affected versions
Lxml	Lxml	from 1.2 before 4.6.2
Redhat	Software Collections	All versions
Redhat	Enterprise Linux	Version 8.0
Debian	Debian Linux	Versions 9.0, 10.0
Fedoraproject	Fedora	Versions 32, 33
Netapp	Snapcenter	All versions
Oracle	Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle	Zfs Storage Appliance Kit	Version 8.8

Weakness classification

CWE-79

References

NVD record
CVE.org record
https://advisory.checkmarx.net/advisory/CX-2020-4286
https://bugzilla.redhat.com/show_bug.cgi?id=1901633
https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/
https://security.netapp.com/advisory/ntap-20210521-0003/
https://www.debian.org/security/2020/dsa-4810
https://www.oracle.com//security-alerts/cpujul2021.html
https://advisory.checkmarx.net/advisory/CX-2020-4286
https://bugzilla.redhat.com/show_bug.cgi?id=1901633
https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK/
https://security.netapp.com/advisory/ntap-20210521-0003/
https://www.debian.org/security/2020/dsa-4810
https://www.oracle.com//security-alerts/cpujul2021.html