CVE-2020-27783 lxml vulnerable to Cross-site Scripting
A remote attacker can execute arbitrary HTML/JS code via a cross-site scripting flaw in the python-lxml clean module's parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-27783?
CVE-2020-27783 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 3 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Weakness: CWE-79
Which versions are affected by CVE-2020-27783?
3 open source packages ship an affected version, including lxml. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
lxml PyPI | All versions | 4.6.2 |
lxml PyPI | All versions | 4.6.2 |
lxml PyPI | From 1.2 | 4.6.2 |
Linux distribution packages (8)
python-lxml Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-2.el8 |
python-lxml-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-2.el8 |
python3-lxml Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-2.el8 |
python3-lxml-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:4.2.3-2.el8 |
python-lxml Rocky Linux:8 | All versions | 0:4.2.3-2.el8 |
python3-lxml SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 3.3.5-3.12.1 |
python3-lxml SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.1-3.3.1 |
python3-lxml SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.1-3.3.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Lxml Lxml, Netapp Snapcenter, Oracle Communications Offline Mediation Controller, Oracle Zfs Storage Appliance Kit and 2 more.
How do I fix CVE-2020-27783?
Upgrade lxml to 4.6.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-27783 being exploited?
There is no known exploitation of CVE-2020-27783 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-27783, AZL-6807, DEBIAN-CVE-2020-27783, DSA-4810-1, GHSA-pgww-xf46-h92r, MGASA-2021-0038 and 9 more.