Vulnerability Details CVE-2020-13973
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 63.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
Products affected by CVE-2020-13973
-
cpe:2.3:a:owasp:json-sanitizer:1.0
-
cpe:2.3:a:owasp:json-sanitizer:1.1
-
cpe:2.3:a:owasp:json-sanitizer:1.2.0