CVE-2023-39318

Aliases:GO-2023-2041BIT-golang-2023-39318DEBIAN-CVE-2023-39318CGA-2944-x86v-qw72CGA-43pq-3rxm-qj5wCGA-47pv-626q-vj3hCGA-4fm3-m7f9-wm6mCGA-53vm-69fr-j52pCGA-6mpp-8jmp-489cCGA-7qj2-4h75-f68pCGA-cmx2-79h8-q76xCGA-cqh8-48c5-hfvvCGA-fr2c-cwc4-3pxcCGA-g5r3-hh3v-4w65CGA-g8vp-mxjq-c223CGA-hwhc-gpp5-34fpCGA-j5p8-8fpp-qcrfCGA-mm52-6q2r-467xCGA-qch2-cv7q-4wh4CGA-qvm5-p6v3-q2h3CGA-qwm5-vghv-6j3fCGA-r7rv-m3jq-jffrCGA-wfqw-w9m9-272vCGA-whq4-vg92-2rc2CGA-xc9j-wcpp-gjvjCGA-763j-qq9m-26ghCGA-wxhh-8vcr-q2xw
Advisory lineage Upstream: 0 Downstream: 26
Modified
Published: 08 Sept 2023, 16:13
Last modified:13 Feb 2025, 17:02

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.94% LOW
1% probability +0.85%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 Sept 2023, 16:13
Published
Vulnerability first disclosed
13 Feb 2025, 17:02
Last Modified
Vulnerability information updated

Description

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.94%• Percentile: 59%

Techniques & Countermeasures

  • CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kind

    < 0.21.0-r0

  • chainguard•metrics-server

    < 0.6.4-r1

  • wolfi•katib-earlystopping

    < 0.19.0-r31

  • wolfi•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • wolfi•katib-suggestion-hyperband

    < 0.19.0-r31

  • wolfi•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • wolfi•katib-suggestion-nas-darts

    < 0.19.0-r31

  • wolfi•katib-suggestion-nas-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • wolfi•katib-tfevent-metricscollector

    < 0.19.0-r31

  • wolfi•kind

    < 0.21.0-r0

  • wolfi•metrics-server

    < 0.6.4-r1

  • debian•golang-1.15

    all

  • debian•golang-1.19

    all

  • go standard library•html/template

    < 1.20.8 | ≥ 1.21.0-0, < 1.21.1

  • golang•go

    < 1.20.8 | ≥ 1.21.0, < 1.21.1

  • Go•stdlib

    ≥ 1.21.0-0, < 1.21.1

References (7)