CVE-2023-38500 json
By-passing Cross-Site Scripting Protection in HTML Sanitizer
published 2023-07-25 3 y ago modified 2026-09-10 1 mo ago also GHSA-59jf-3q9v-rh6g , EUVD-2023-1965
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Starting in version 1.0.0 and prior to versions 1.5.1 and 2.1.2, due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of TYPO3 HTML Sanitizer. Versions 1.5.1 and 2.1.2 fix the problem.
Patch / fix
- packagist typo3/html-sanitizer 1.5.1, 2.1.2
- typo3 html_sanitizer 1.5.1, 2.1.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/html-sanitizer | >=1.0.0, <1.5.1 >=2.0.0, <2.1.2 |
1.5.1 2.1.2 |
Affected products
- TYPO3 html-sanitizer
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/TYPO3/html-sanitizer/commit/e3026f589fef0be8c3574ee3f0a0bfbe33d7ebdb
web, patch
-
github.com
/TYPO3/html-sanitizer/security/advisories/GHSA-59jf-3q9v-rh6g
web, vendor-advisory
-
typo3.org
/security/advisory/typo3-core-sa-2023-002
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-38500
advisory
-
github.com
/TYPO3/html-sanitizer
package
Sources
- CVE List CVE-2023-38500
- GitHub Advisory GHSA-59jf-3q9v-rh6g
- NVD CVE-2023-38500
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.