CVE-2021-29272: XSS
Published Mar 27, 2021
·Updated
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
Affected Software
2 affected componentsFixes available
Microco Bluemonday<1.0.5
go/github.com/microcosm-cc/bluemonday<1.0.5
1.0.5
Event History
Mar 27, 2021
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
Description
May 18, 2021
Advisory Published
via GitHub·09:07 PM
Frequently Asked Questions
1
What is CVE-2021-29272?
CVE-2021-29272 is a vulnerability in the bluemonday package before version 1.0.5 that allows cross-site scripting (XSS) attacks.
2
What is the severity of CVE-2021-29272?
The severity of CVE-2021-29272 is medium with a CVSS score of 6.1.
3
How does CVE-2021-29272 work?
CVE-2021-29272 occurs because certain Go lowercasing converts an uppercase Cyrillic character, which defeats a protection mechanism against the "script" string, allowing for XSS attacks.
4
Which software versions are affected by CVE-2021-29272?
The bluemonday package versions up to and excluding 1.0.5 are affected by CVE-2021-29272.
5
How can I fix CVE-2021-29272?
To fix CVE-2021-29272, upgrade to bluemonday version 1.0.5 or newer.