Published: 11/01/2024 Updated: 27/01/2024

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 0

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Vulnerable Product	Search on Vulmon	Subscribe to Product
palletsprojects jinja

Debian Bug report logs - #1060748 jinja2: CVE-2024-22195: HTML attribute injection when passing user input as keys to xmlattr filter Package: src:jinja2; Maintainer for src:jinja2 is Piotr Ożarowski <piotr@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 13 Jan 2024 16:27:05 UTC Severity ...

Jinja is an extensible templating engine Special placeholders in the template allow writing code similar to Python syntax It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS) The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values ...

Description This CVE is under investigation by Red Hat Product Security ...

F-test is a simple web app test that handles a register format to send data into a MariaDB Database

F-test F-test is a simple web app test that handles a register format to send data into a MariaDB Database made with Flask This simple project is made to learn Flask in a nutshell Check this little wiki / article that I did here :)) Frontend It uses JavaScript, HTML and CSS You can install Node here Backend It uses Flask as a modern framework to build minimal and scalable

CWE-79 https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95 https://github.com/pallets/jinja/releases/tag/3.1.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1060748 https://nvd.nist.gov https://github.com/Its-Yayo/f-test https://alas.aws.amazon.com/AL2/ALAS-2024-2436.html

CVE-2024-22195

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect