CVE-2023-29400

Summary

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Affected Software

Weaknesses

• CWE-74: Improper input validation

ADP Enrichment

CVE Program Container

Additional References

• https://go.dev/issue/59722
• https://go.dev/cl/491617
• https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
• https://pkg.go.dev/vuln/GO-2023-1753
• https://security.netapp.com/advisory/ntap-20241213-0005/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://go.dev/issue/59722
• https://go.dev/cl/491617
• https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU
• https://pkg.go.dev/vuln/GO-2023-1753

• ←Previous
• Next→