CVE-2010-4183: XSS

Q: What is the severity of CVE-2010-4183?

CVE-2010-4183 is associated with multiple cross-site scripting (XSS) vulnerabilities, which are generally considered high severity due to their potential for exploiting user sessions.

Q: How do I fix CVE-2010-4183?

To fix CVE-2010-4183, upgrade to HTML Purifier version 4.1.0 or later, which addresses these security vulnerabilities.

Q: Which software versions are affected by CVE-2010-4183?

CVE-2010-4183 affects all versions of HTML Purifier prior to 4.1.0.

Q: What kind of attacks can CVE-2010-4183 facilitate?

CVE-2010-4183 allows remote attackers to inject arbitrary web scripts or HTML via specific CSS properties, leading to potential data theft or session hijacking.

Q: Is Internet Explorer impacted by CVE-2010-4183?

CVE-2010-4183 specifically targets scenarios where Internet Explorer is used; however, the vulnerability exists within HTML Purifier.

Published Apr 26, 2010

Updated

Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.

Other sources

Multiple XSS vulnerabilities exploitable on Internet Explorer

Affected Software

154 affected componentsFixes available

composer/ezyang/htmlpurifier<4.1.0

4.1.0

All of the following

Any of the following

Htmlpurifier Htmlpurifier<=4.0.0

Htmlpurifier Htmlpurifier=1.0.0

Htmlpurifier Htmlpurifier=1.0.0-beta

Htmlpurifier Htmlpurifier=1.0.1

Htmlpurifier Htmlpurifier=1.1.0

Htmlpurifier Htmlpurifier=1.1.1

Htmlpurifier Htmlpurifier=1.1.2

Htmlpurifier Htmlpurifier=1.2.0

Htmlpurifier Htmlpurifier=1.3.0

Htmlpurifier Htmlpurifier=1.3.1

Htmlpurifier Htmlpurifier=1.3.2

Htmlpurifier Htmlpurifier=1.4.0

Htmlpurifier Htmlpurifier=1.4.1

Htmlpurifier Htmlpurifier=1.5.0

Htmlpurifier Htmlpurifier=1.6.0

Htmlpurifier Htmlpurifier=1.6.1

Htmlpurifier Htmlpurifier=2.0.0

Htmlpurifier Htmlpurifier=2.0.1

Htmlpurifier Htmlpurifier=2.1.0

Htmlpurifier Htmlpurifier=2.1.1

Htmlpurifier Htmlpurifier=2.1.2

Htmlpurifier Htmlpurifier=2.1.3

Htmlpurifier Htmlpurifier=2.1.4

Htmlpurifier Htmlpurifier=2.1.5

Htmlpurifier Htmlpurifier=3.0.0

Htmlpurifier Htmlpurifier=3.1.0

Htmlpurifier Htmlpurifier=3.1.0-rc1

Htmlpurifier Htmlpurifier=3.1.1

Htmlpurifier Htmlpurifier=3.2.0

Htmlpurifier Htmlpurifier=3.3.0

Htmlpurifier Htmlpurifier=4.0.0

Microsoft Internet Explorer