#VU41671 Cross-site scripting in Lxml - CVE-2014-3146


| Updated: 2020-11-27

Vulnerability identifier: #VU41671

Vulnerability risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2014-3146

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Lxml
Client/Desktop applications / Multimedia software

Vendor: Lxml

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. The vulnerability allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Lxml: 0.5 - 3.3.3

External links
https://advisories.mageia.org/MGASA-2014-0218.html
https://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html
https://lxml.de/3.3/changes-3.3.5.html
https://seclists.org/fulldisclosure/2014/Apr/210
https://seclists.org/fulldisclosure/2014/Apr/319
https://secunia.com/advisories/58013
https://secunia.com/advisories/58744
https://secunia.com/advisories/59008
https://www.debian.org/security/2014/dsa-2941
https://www.mandriva.com/security/advisories?name=MDVSA-2015:112
https://www.openwall.com/lists/oss-security/2014/05/09/7
https://www.securityfocus.com/bid/67159
https://www.ubuntu.com/usn/USN-2217-1
https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Juniper Secure Analytics (JSA)
Multiple vulnerabilities in IBM QRadar SIEM
Cross-site scripting in Lxml