medium
6.1
CWE
79
Advisory Published
CVE Published
Updated

CVE-2023-39318: Improper handling of HTML-like comments in script contexts in html/template

First published: Wed Sep 06 2023(Updated: )

Golang Go is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the html/template package. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Credit: security@golang.org security@golang.org security@golang.org

Affected SoftwareAffected VersionHow to fix
Golang Go<1.20.8
Golang Go>=1.21.0<1.21.1
IBM Planning Analytics<=2.0
ubuntu/golang-1.20<1.20.3-1ubuntu0.1~20.04.1
1.20.3-1ubuntu0.1~20.04.1
ubuntu/golang-1.20<1.20.3-1ubuntu0.1~22.04.1
1.20.3-1ubuntu0.1~22.04.1
ubuntu/golang-1.20<1.20.3-1ubuntu0.2
1.20.3-1ubuntu0.2
ubuntu/golang-1.20<1.20.8
1.20.8
ubuntu/golang-1.21<1.21.1
1.21.1
redhat/golang<1.20.8
1.20.8
redhat/golang<1.21.1
1.21.1
debian/golang-1.11<=1.11.6-1+deb10u4<=1.11.6-1+deb10u7
debian/golang-1.15<=1.15.15-1~deb11u4
debian/golang-1.19<=1.19.8-2
debian/golang-1.21
1.21.10-1

Remedy

https://go.dev/cl/526156

Remedy

https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c

Remedy

https://github.com/golang/go/commit/b0e1d3ea26e8e8fce7726690c9ef0597e60739fb

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the vulnerability ID?

    The vulnerability ID is CVE-2023-39318.

  • What is the severity of CVE-2023-39318?

    The severity of CVE-2023-39318 is medium.

  • What is the affected software for CVE-2023-39318?

    The affected software for CVE-2023-39318 is Golang Go versions between 1.20.8 and 1.21.1.

  • How does CVE-2023-39318 affect the html/template package?

    CVE-2023-39318 affects the html/template package by not properly handling HTML-like comment tokens and hashbang #! comment tokens in <script> contexts, leading to improper interpretation of contents and potential escaping issues.

  • Are there any references related to CVE-2023-39318?

    Yes, here are some references related to CVE-2023-39318: [Link 1](https://go.dev/cl/526156), [Link 2](https://go.dev/issue/62196), [Link 3](https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203