CVE-2021-43818

Published: Dic 13, 2021 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2021-0117 Aliases: GHSA-55x5-fj6c-h6m8, PYSEC-2021-852
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: high
Availability: none
MEDIUM 6,8
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial

Description

AI Translation Available

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0280
Percentile
0,9th
Updated

EPSS Score Trend (Last 90 Days)

74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Access Control Other Integrity Non-Repudiation
Potential Impacts:
Read Application Data Bypass Protection Mechanism Alter Execution Logic Other Hide Activities
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Hci Storage Node Firmware by Netapp

Product Information
Vendor Netapp
Product Hci Storage Node Firmware
Version -
cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Solidfire Enterprise Sds by Netapp

Product Information
Vendor Netapp
Product Solidfire Enterprise Sds
Version -
cpe:2.3:a:netapp:solidfire_enterprise_sds:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Communications Cloud Native Core Binding Support Function by Oracle

Product Information
Vendor Oracle
Product Communications Cloud Native Core Binding Support Function
Version 22.1.3
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Communications Cloud Native Core Policy by Oracle

Product Information
Vendor Oracle
Product Communications Cloud Native Core Policy
Version 22.2.0
cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.2.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 35
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Communications Cloud Native Core Network Exposure Function by Oracle

Product Information
Vendor Oracle
Product Communications Cloud Native Core Network Exposure Function
Version 22.1.1
cpe:2.3:a:oracle:communications_cloud_native_core_network_exposure_function:22.1.1:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Solidfire by Netapp

Product Information
Vendor Netapp
Product Solidfire
Version -
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 34
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Http Server by Oracle

Product Information
Vendor Oracle
Product Http Server
Version 12.2.1.4.0
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zfs Storage Appliance Kit by Oracle

Product Information
Vendor Oracle
Product Zfs Storage Appliance Kit
Version 8.8
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Lxml by Lxml

Product Information
Vendor Lxml
Product Lxml
Version Range Affected
To 4.6.5 (exclusive)
cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Http Server by Oracle

Product Information
Vendor Oracle
Product Http Server
Version 12.2.1.3.0
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d99…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#di…
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-…
Third Party Advisory
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
https://lists.debian.org/debian-lts-announce/2021/12/msg000…
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://security.gentoo.org/glsa/202208-06
Third Party Advisory
https://security.gentoo.org/glsa/202208-06
https://security.netapp.com/advisory/ntap-20220107-0005/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220107-0005/
https://www.debian.org/security/2022/dsa-5043
Third Party Advisory
https://www.debian.org/security/2022/dsa-5043
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d99…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#di…
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad…
Patch Third Party Advisory
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-…
Third Party Advisory
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
https://lists.debian.org/debian-lts-announce/2021/12/msg000…
Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://security.gentoo.org/glsa/202208-06
Third Party Advisory
https://security.gentoo.org/glsa/202208-06
https://security.netapp.com/advisory/ntap-20220107-0005/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220107-0005/
https://www.debian.org/security/2022/dsa-5043
Third Party Advisory
https://www.debian.org/security/2022/dsa-5043
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html