CVE-2023-36823

CVSS Score of 10 (low)

Details

Published Jul 6, 2023
Updated: Dec 22, 2023
CWE ID 79

Summary

CVE-2023-36823 is a vulnerability in the Sanitize software, versions 3.0.0 to 6.0.2, that allows an attacker to bypass HTML and CSS sanitization when certain configurations are used. This can lead to cross-site scripting attacks or other undesired behavior when the malicious code is rendered in a browser. The vulnerability can be remediated by upgrading to version 6.0.2, which includes additional escaping of CSS in `style` element content. Alternatively, users can use a Sanitize configuration that disallows `style` elements or CSS at-rules, or manually escape the character sequence `</` as `<\/` in `style` element content. The vulnerability has a medium severity rating according to NIST and a high severity rating according to security advisories from GitHub, with a CVSS score of 6.1 and 7.1 respectively. The affected products include various versions of Sanitize as well as other related products, posing potential danger to organizations using these software components for HTML and CSS sanitization purposes.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-36823 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options