CVE-2021-28957 describes an XSS vulnerability in python-lxml's clean module, affecting versions prior to 4.6.3, as well as products like Debian, FedoraProject, NetApp, and Oracle. This flaw allows remote attackers to execute arbitrary JavaScript by bypassing the sanitizer when the safe_attrs_only and forms arguments are disabled, as the 'formaction' attribute is not properly removed. Rated 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), it has a low EPSS score and is not on the KEV or Hot List. There is no public exploit code (Metasploit, Nuclei, ExploitDB), but it has received some community discussion and media coverage, including a mention in a SecurityWeek article regarding Splunk Enterprise updates.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.6.3CPE matchmatch criteria | cpe:2.3:a:lxml:lxml:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
February Third Party Package Updates in Splunk Enterprise
Feb 14, 2023CVE-2021-28957
Jul 13, 2021lxml vulnerable to Cross-Site Scripting
Mar 22, 2021python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS
Mar 21, 2021An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
Mar 9, 2021