CVE-2024-22195

Public on 2024-01-11
Modified on 2024-06-28
Description
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Severity
Medium severity
Medium
CVSS v3 Base Score
5.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 python-jinja2 No Fix Planned
Amazon Linux 2 - Core python-jinja2 2024-02-01 ALAS2-2024-2436 Fixed
Amazon Linux 2023 python-jinja2 2024-02-01 ALAS2023-2024-503 Fixed
Amazon Linux 2 - Core python3-jinja2 2024-02-01 ALAS2-2024-2437 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD CVSSv3 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N