CVE-2020-6802 XSS in Bleach when noscript and raw tag whitelisted
Mutation XSS in Mozilla Bleach allows code execution when cleaning HTML with specific noscript and raw tag configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-6802?
CVE-2020-6802 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 24 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Mozilla Bleach before 3.11, a mutation XSS affects users calling bleach.clean with noscript and a raw tag in the allowed/whitelisted tags option.
Weakness: CWE-79
Which versions are affected by CVE-2020-6802?
3 open source packages ship an affected version, including bleach. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
bleach PyPI | All versions | 3.1.1 |
bleach PyPI | All versions | 3.1.1 |
bleach PyPI | All versions | 3.1.1 |
Linux distribution packages (3)
python-bleach SUSE:Package Hub 15 SP1 | All versions | 3.1.1-bp151.4.4.1 |
python-bleach openSUSE:Leap 15.1 | All versions | 3.1.1-lp151.3.6.1 |
weblate openSUSE:Tumbleweed | All versions | 4.8.1-1.1 |
Products include Fedoraproject Fedora, Mozilla Bleach.
How do I fix CVE-2020-6802?
Upgrade bleach to 3.1.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-6802 being exploited?
There is no known exploitation of CVE-2020-6802 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-6802, DSA-4636-1, GHSA-q65m-pv3f-wr5r, MGASA-2020-0125, PYSEC-2020-27, UBUNTU-CVE-2020-6802 and 3 more.