CVE-2022-23515: Improper neutralization of data URIs may allow XSS in Loofah
Summary
Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs.
Mitigation
Upgrade to Loofah >= 2.19.1.
Severity
The Loofah maintainers have evaluated this as Medium Severity 6.1.
References
- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9) - SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg - https://hackerone.com/reports/1694173 - https://github.com/flavorjones/loofah/issues/101
Credit
This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
Other sources
A Cross-site scripting vulnerability was found in rubygem loofah. While neutralizing certain data URIs, loofah is susceptible to Cross-site scripting attacks.
Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-23515.
What is the severity level of CVE-2022-23515?
CVE-2022-23515 has a severity level of Medium (6.1).
Which software version is affected by CVE-2022-23515?
The Loofah software version from 2.1.0 to 2.19.1 is affected by CVE-2022-23515.
How can I mitigate CVE-2022-23515?
You can mitigate CVE-2022-23515 by upgrading to Loofah version 2.19.1 or higher.
Where can I find more information about CVE-2022-23515?
You can find more information about CVE-2022-23515 on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-23515) and the NVD website (https://nvd.nist.gov/vuln/detail/CVE-2022-23515).