CVE-2014-3146: XSS
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the cleanhtml function.
Other sources
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the cleanhtml function.
lxml could allow a remote attacker to bypass security restrictions, caused by the improper validation of input by the cleanhtml() function. By sending a specially-crafted request, an attacker could exploit this vulnerability and perform unauthorized actions.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3146?
CVE-2014-3146 is considered a moderate severity vulnerability as it allows for cross-site scripting (XSS) attacks.
How do I fix CVE-2014-3146?
To fix CVE-2014-3146, upgrade lxml to version 3.3.5 or higher.
What specific feature in lxml is affected by CVE-2014-3146?
CVE-2014-3146 affects the `lxml.html.clean` module, which has an incomplete blacklist.
Which software versions are impacted by CVE-2014-3146?
Versions of lxml prior to 3.3.5, including all releases up to 3.3.4, are impacted by CVE-2014-3146.
Can CVE-2014-3146 lead to data theft?
Yes, CVE-2014-3146 can allow attackers to execute arbitrary scripts in the user's browser, potentially leading to data theft.