Publish Advisories

GHSA-x77j-w7wf-fjmw
GHSA-r68h-jhhj-9jvm

advisories/github-reviewed/2023/04/GHSA-x77j-w7wf-fjmw/GHSA-x77j-w7wf-fjmw.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x77j-w7wf-fjmw",
-  "modified": "2023-04-20T21:19:24Z",
+  "modified": "2024-11-26T18:54:25Z",
   "published": "2023-04-20T21:19:24Z",
   "aliases": [
     "CVE-2023-2142"
@@ -9,7 +9,14 @@
   "summary": "Nunjucks autoescape bypass leads to cross site scripting",
   "details": "### Impact\nIn Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash `\\` character.\n\n#### Example\nIf the user-controlled parameters were used in the views similar to the following:\n```\n<script>\nlet testObject = { lang: '{{ lang }}', place: '{{ place }}' };\n</script>\n```\n\nIt is possible to inject XSS payload using the below parameters:\n```\nhttps://<application-url>/?lang=jp\\&place=};alert(document.domain)//\n```\n\n### Patches\nThe issue was patched in version 3.2.4.\n\n### References\n\n- https://bugzilla.mozilla.org/show_bug.cgi?id=1825980\n",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
   ],
   "affected": [
     {
@@ -37,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2142"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/mozilla/nunjucks/pull/1437"
@@ -65,6 +76,6 @@
     "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2023-04-20T21:19:24Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-11-26T12:15:18Z"
   }
 }