CVE-2010-2479: HTML Purifier Cross-site Scripting (XSS) vulnerability in ezyang/htmlpurifier
Summary
CVE-2010-2479: HTML Purifier Cross-site Scripting (XSS) vulnerability. Affects ezyang/htmlpurifier versions < 4.1.1. Fixed in 4.1.1. How to fix ↓
Also tracked for
- php-htmlpurifier · Debian:11
The same CVE-2010-2479 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ezyang/htmlpurifier package is a library that provides HTML sanitization functionality. It is commonly used in web applications to prevent cross-site scripting (XSS) attacks by filtering and cleaning user-generated HTML content. However, versions of HTML Purifier prior to 4.1.1 are vulnerable to a specific type of XSS attack when used with Internet Explorer.
Vulnerability Detail
The vulnerability allows remote attackers to inject arbitrary web script or HTML into web pages when the browser is Internet Explorer. This can lead to various security issues, such as session hijacking, defacement of web pages, or stealing sensitive information from users. The exact vectors of the attack are unspecified in the available information.
How To Fix
Minimum fixed version
4.1.1
This is the first release that contains the fix.
composer require ezyang/htmlpurifier:4.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned in the available information. However, as a general best practice, developers can implement additional input validation and output encoding to mitigate the risk of XSS attacks. This can involve using security libraries or frameworks that provide built-in protection against XSS vulnerabilities.
Conclusion
The HTML Purifier Cross-site Scripting (XSS) vulnerability in the ezyang/htmlpurifier package can allow remote attackers to inject arbitrary web script or HTML into web pages when used with Internet Explorer. To mitigate this vulnerability, it is crucial to upgrade to version 4.1.1 or later of the package. Developers should also consider implementing additional input validation and output encoding to enhance the security of their web applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ezyang/htmlpurifier →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML into web pages, potentially leading to various security issues such as session hijacking, defacement of web pages, or stealing sensitive information from users.
Versions of HTML Purifier prior to 4.1.1 are affected by this vulnerability.
Only web applications that use HTML Purifier in conjunction with Internet Explorer are vulnerable to this specific XSS attack. Applications that do not use Internet Explorer or use a different HTML sanitization library are not affected.
Yes, the vulnerability can be fixed by upgrading the ezyang/htmlpurifier package to version 4.1.1 or later.
The available information does not mention any specific known exploits for this vulnerability. However, it is always recommended to promptly apply security patches to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for ezyang/htmlpurifier.
