What is GHSA-6fh7-fwqj-mv49?

GHSA-6fh7-fwqj-mv49 is a security advisory published by GitHub Security Advisories with Medium severity. HTML Purifier Cross-site Scripting vulnerability

Which CVE IDs does GHSA-6fh7-fwqj-mv49 cover?

GHSA-6fh7-fwqj-mv49 covers the following CVE IDs: CVE-2007-3498. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6fh7-fwqj-mv49?

GHSA-6fh7-fwqj-mv49 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6fh7-fwqj-mv49?

GHSA-6fh7-fwqj-mv49 affects 1 product, including: composer/ezyang/htmlpurifier:\u003c 2.0.1.

GHSA-6fh7-fwqj-mv49MediumCVSS 6.1

HTML Purifier Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

May 1, 2022

Last Modified

October 29, 2024

🔗 CVE IDs covered (1)

CVE-2007-3498 →

📋 Description

Cross-site scripting (XSS) vulnerability in smoketests/configForm.php in HTML Purifier before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "unescaped print_r output."

🎯 Affected products1

composer/ezyang/htmlpurifier:< 2.0.1

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2007-3498
https://exchange.xforce.ibmcloud.com/vulnerabilities/35300
http://htmlpurifier.org/svnroot/htmlpurifier/tags/2.0.1/NEWS
https://github.com/ezyang/htmlpurifier/commit/96b571d23639bd70768b8db626ecaf8bbb7ca5a3
https://github.com/ezyang/htmlpurifier/commits/v2.0.1/smoketests/configForm.php
https://web.archive.org/web/20200228110020/http://www.securityfocus.com/bid/24699
https://github.com/advisories/GHSA-6fh7-fwqj-mv49