CVE-2020-27783

moderate-risk

Published 2020-12-03

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.

Do I need to act?

1.2% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (10)

Lxml

Software Collections

Enterprise Linux

Debian Linux

Fedora

Snapcenter

Communications Offline Mediation Controller

Zfs Storage Appliance Kit

Affected Vendors

Debian Redhat Oracle Fedoraproject Netapp Lxml

References (16)

Exploit https://advisory.checkmarx.net/advisory/CX-2020-4286

Exploit https://bugzilla.redhat.com/show_bug.cgi?id=1901633

Mailing List https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0003/

Third Party Advisory https://www.debian.org/security/2020/dsa-4810

Patch https://www.oracle.com//security-alerts/cpujul2021.html

Exploit https://advisory.checkmarx.net/advisory/CX-2020-4286

Exploit https://bugzilla.redhat.com/show_bug.cgi?id=1901633

Mailing List https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://security.netapp.com/advisory/ntap-20210521-0003/

Third Party Advisory https://www.debian.org/security/2020/dsa-4810

Patch https://www.oracle.com//security-alerts/cpujul2021.html

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 4/34 · Minimal

Exposure 16/34 · Moderate