Vulnerability Name:

CVE-2020-27783 (CCN-192644)

Assigned:2020-10-18
Published:2020-10-18
Updated:2022-08-06
Summary:A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.4 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2020-27783

Source: MISC
Type: Exploit, Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2020-4286

Source: CCN
Type: Red Hat Bugzilla - Bug 1901633
CVE-2020-27783 python-lxml: mXSS due to the use of improper parser

Source: MISC
Type: Exploit, Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1901633

Source: XF
Type: UNKNOWN
lxml-cve202027783-xss(192644)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20201218 [SECURITY] [DLA 2467-2] lxml regression update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-307946cfb6

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-0e055ea503

Source: CCN
Type: Python Web site
lxml 4.6.2

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210521-0003/

Source: DEBIAN
Type: Third Party Advisory
DSA-4810

Source: CCN
Type: IBM Security Bulletin 6493729 (Cloud Pak for Security)
Cloud Pak for Security is vulnerable to several CVEs

Source: N/A
Type: Patch, Third Party Advisory
N/A

Vulnerable Configuration:Configuration 1:
  • cpe:/a:lxml:lxml:*:*:*:*:*:*:*:* (Version >= 1.2 and < 4.6.2)

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:software_collections:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/a:netapp:snapcenter:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:lxml:lxml:3.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:lxml:lxml:4.2.4:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7775
    P
    		python3-lxml-4.9.1-150500.1.2 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3172
    P
    		libfreebl3-3.45-58.31.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94802
    P
    		python3-lxml-4.7.1-3.7.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:6201
    P
    		Security update for python-lxml (Moderate)
    2022-03-17
    oval:org.opensuse.security:def:94061
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:1588
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:99761
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:93487
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:101660
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:119336
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:94275
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:100094
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:118841
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:93638
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:102148
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:99225
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:119519
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:94482
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:93169
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:100432
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:119031
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:93849
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:968
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:99499
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:119704
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:93327
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:100766
    P
    		 (Important)
    2022-03-10
    oval:org.opensuse.security:def:119142
    P
    		Security update for python-lxml (Important)
    2022-03-10
    oval:org.opensuse.security:def:113208
    P
    		python-lxml-doc-4.6.3-3.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106628
    P
    		python-lxml-doc-4.6.3-3.2 on GA media (Moderate)
    2021-10-01
    oval:com.redhat.rhsa:def:20211761
    P
    		RHSA-2021:1761: python27:2.7 security and bug fix update (Moderate)
    2021-05-18
    oval:com.redhat.rhsa:def:20211879
    P
    		RHSA-2021:1879: python38:3.8 security update (Moderate)
    2021-05-18
    oval:com.redhat.rhsa:def:20211898
    P
    		RHSA-2021:1898: python-lxml security update (Moderate)
    2021-05-18
    BACK
    lxml lxml *
    redhat enterprise linux 8.0
    redhat software collections -
    debian debian linux 9.0
    debian debian linux 10.0
    fedoraproject fedora 32
    fedoraproject fedora 33
    netapp snapcenter -
    oracle communications offline mediation controller 12.0.0.3.0
    oracle zfs storage appliance kit 8.8
    lxml lxml 3.3.4
    lxml lxml 4.2.4
    ibm cloud pak for security 1.7.0.0
    ibm cloud pak for security 1.7.1.0