CVE-2020-27783 vulnerability in Lxml and Other Products
Published on December 3, 2020

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-27783 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2020-27783 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2020-27783

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-27783 are published in these products:

Lxml

Red Hat Software Collections

Red Hat Enterprise Linux (RHEL)

Debian Linux

Fedora Project Fedora

NetApp Snapcenter

Oracle Communications Offline Mediation Controller

Oracle Zfs Storage Appliance Kit

Exploit Probability

EPSS

1.25%

Percentile

79.15%