CVE-2020-27783 describes a Cross-Site Scripting (XSS) vulnerability in the python-lxml clean module, impacting products like Debian, Fedora, and Oracle. The flaw stems from the module's parser failing to accurately mimic browser behavior, allowing a remote attacker to inject and execute arbitrary HTML/JS code. Rated as Medium severity (CVSS 6.1), exploitation requires user interaction (UI:R) but has low attack complexity (AC:L), potentially leading to limited confidentiality and integrity impacts. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.2, < 4.6.2CPE matchmatch criteria | cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-27783
Jul 13, 2021lxml vulnerable to Cross-site Scripting
Jan 7, 2021A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Dec 8, 2020python-lxml: mXSS due to the use of improper parser
Oct 18, 2020