← Back

CVE-2020-27783

nvd nist
Published: Dec 3, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Affected (10)

Show all products
Lxml: Lxml · Redhat: Enterprise Linux, Software Collections · Debian: Debian Linux · Fedoraproject: Fedora · Netapp: Snapcenter · Oracle: Communications Offline Mediation Controller, Zfs Storage Appliance Kit
Lxml
1 product
Lxml
Redhat
2 products
Enterprise Linux
Software Collections
Debian
1 product
Debian Linux
Fedoraproject
1 product
Fedora
Netapp
1 product
Snapcenter
Oracle
2 products
Communications Offline Mediation Controller
Zfs Storage Appliance Kit
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Lxml
From 1.2 to 4.6.2
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Enterprise Linux
Version 8.0
Software Collections
All versions
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 32
Fedora
Version 33
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Snapcenter
All versions
Configuration F
2 vulnerable
Vulnerable SoftwareAffected Versions
Communications Offline Mediation Controller
Version 12.0.0.3.0
Zfs Storage Appliance Kit
Version 8.8

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (16)

Source: secalert@redhat.com
ExploitThird Party Advisory
Source: secalert@redhat.com
ExploitIssue TrackingPatchThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory

Timeline

No history available yet.