CVE-2024-24785

Aliases:CGA-97f2-3j6h-f6frBIT-golang-2024-24785CGA-q7f3-cq9g-gr7fCGA-wgjf-hp76-8hxwGHSA-j6m3-gc37-6r6qGO-2024-2610
Advisory lineage Upstream: 0 Downstream: 22
Deferred
Published: 05 Mar 2024, 22:22
Last modified:14 Mar 2025, 00:55

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.4 MEDIUM
v3.1 (cve.org)
EPSS Score
0.92% LOW
1% probability +0.65%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Mar 2024, 22:22
Published
Vulnerability first disclosed
14 Mar 2025, 00:55
Last Modified
Vulnerability information updated

Description

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.92%• Percentile: 76%

Affected Systems

  • chainguard•cluster-autoscaler-1.27

    < 1.27.5-r2

  • chainguard•cluster-autoscaler-1.27-compat

    < 1.27.5-r2

  • chainguard•cluster-autoscaler-1.28

    < 1.28.2-r2

  • chainguard•cluster-autoscaler-1.28-compat

    < 1.28.2-r2

  • chainguard•newrelic-fluent-bit-output

    < 1.19.2-r1

  • wolfi•cluster-autoscaler-1.27

    < 1.27.5-r2

  • wolfi•cluster-autoscaler-1.27-compat

    < 1.27.5-r2

  • wolfi•cluster-autoscaler-1.28

    < 1.28.2-r2

  • wolfi•cluster-autoscaler-1.28-compat

    < 1.28.2-r2

  • go standard library•html/template

    < 1.21.8 | ≥ 1.22.0-0, < 1.22.1

  • Go•stdlib

    ≥ 1.22.0-0, < 1.22.1

References (6)