CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-36020

The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. Due to a parsing issue in the upstream package `masterminds/html5`, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows for a bypass of the cross-site scripting mechanism of `typo3/html-sanitizer`. This issue has been addressed in versions 1.0.7 and 2.0.16 of the `typo3/html-sanitizer` package. Users are advised to upgrade. There are no known workarounds for this issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 28.8%

CVSS Severity

CVSS v3 Score 6.1

References

Products affected by CVE-2022-36020

Typo3 » Html Sanitizer » Version: 1.0.0

cpe:2.3:a:typo3:html_sanitizer:1.0.0
Typo3 » Html Sanitizer » Version: 1.0.1

cpe:2.3:a:typo3:html_sanitizer:1.0.1
Typo3 » Html Sanitizer » Version: 1.0.2

cpe:2.3:a:typo3:html_sanitizer:1.0.2
Typo3 » Html Sanitizer » Version: 1.0.3

cpe:2.3:a:typo3:html_sanitizer:1.0.3
Typo3 » Html Sanitizer » Version: 1.0.4

cpe:2.3:a:typo3:html_sanitizer:1.0.4
Typo3 » Html Sanitizer » Version: 1.0.5

cpe:2.3:a:typo3:html_sanitizer:1.0.5
Typo3 » Html Sanitizer » Version: 1.0.6

cpe:2.3:a:typo3:html_sanitizer:1.0.6
Typo3 » Html Sanitizer » Version: 2.0.0

cpe:2.3:a:typo3:html_sanitizer:2.0.0
Typo3 » Html Sanitizer » Version: 2.0.1

cpe:2.3:a:typo3:html_sanitizer:2.0.1
Typo3 » Html Sanitizer » Version: 2.0.10

cpe:2.3:a:typo3:html_sanitizer:2.0.10
Typo3 » Html Sanitizer » Version: 2.0.11

cpe:2.3:a:typo3:html_sanitizer:2.0.11
Typo3 » Html Sanitizer » Version: 2.0.12

cpe:2.3:a:typo3:html_sanitizer:2.0.12
Typo3 » Html Sanitizer » Version: 2.0.13

cpe:2.3:a:typo3:html_sanitizer:2.0.13
Typo3 » Html Sanitizer » Version: 2.0.14

cpe:2.3:a:typo3:html_sanitizer:2.0.14
Typo3 » Html Sanitizer » Version: 2.0.15

cpe:2.3:a:typo3:html_sanitizer:2.0.15
Typo3 » Html Sanitizer » Version: 2.0.2

cpe:2.3:a:typo3:html_sanitizer:2.0.2
Typo3 » Html Sanitizer » Version: 2.0.3

cpe:2.3:a:typo3:html_sanitizer:2.0.3
Typo3 » Html Sanitizer » Version: 2.0.4

cpe:2.3:a:typo3:html_sanitizer:2.0.4
Typo3 » Html Sanitizer » Version: 2.0.5

cpe:2.3:a:typo3:html_sanitizer:2.0.5
Typo3 » Html Sanitizer » Version: 2.0.6

cpe:2.3:a:typo3:html_sanitizer:2.0.6
Typo3 » Html Sanitizer » Version: 2.0.7

cpe:2.3:a:typo3:html_sanitizer:2.0.7
Typo3 » Html Sanitizer » Version: 2.0.8

cpe:2.3:a:typo3:html_sanitizer:2.0.8
Typo3 » Html Sanitizer » Version: 2.0.9

cpe:2.3:a:typo3:html_sanitizer:2.0.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2022-36020

Products

Pricing

Contact Us