Vulnerabilities > CVE-2014-3146 - Unspecified vulnerability in Lxml

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
lxml
nessus
exploit available
NVD
Published: 2014-05-14
Updated: 2024-11-21

Summary

Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.

Vulnerable Configurations

Part Description Count
Application
Lxml
97

Exploit-Db

descriptionlxml 'clean_html' Function Security Bypass Vulnerability. CVE-2014-3146. Remote exploit for linux platform
idEDB-ID:39155
last seen2016-02-04
modified2014-04-15
published2014-04-15
reporterMaksim Kochkin
sourcehttps://www.exploit-db.com/download/39155/
titlelxml 'clean_html' Function Security Bypass Vulnerability

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2014-088.NASL
    descriptionUpdated python-lxml packages fix security vulnerability : The clean_html() function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters (\x01-\x08). A remote attacker could use this flaw to serve malicious content to an application using the clean_html() function to process HTML, possibly allowing the attacker to inject malicious code into a website generated by this application (CVE-2014-3146).
    last seen2020-06-01
    modified2020-06-02
    plugin id74030
    published2014-05-16
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74030
    titleMandriva Linux Security Advisory : python-lxml (MDVSA-2014:088)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1604.NASL
    descriptionIt was discovered that there was a XSS injection vulnerability in the LXML HTML/XSS manipulation library for Python. LXML did not remove
    last seen2020-04-30
    modified2018-12-11
    plugin id119560
    published2018-12-11
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119560
    titleDebian DLA-1604-1 : lxml security update
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2015-112.NASL
    descriptionUpdated python-lxml packages fix security vulnerability : The clean_html() function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters (\x01-\x08). A remote attacker could use this flaw to serve malicious content to an application using the clean_html() function to process HTML, possibly allowing the attacker to inject malicious code into a website generated by this application (CVE-2014-3146).
    last seen2020-06-01
    modified2020-06-02
    plugin id82365
    published2015-03-30
    reporterThis script is Copyright (C) 2015-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/82365
    titleMandriva Linux Security Advisory : python-lxml (MDVSA-2015:112)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2014-402.NASL
    descriptionpython-lxml was fixed to ensure proper input sanitization in clean_html (CVE-2014-3146).
    last seen2020-06-05
    modified2014-06-13
    plugin id75380
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75380
    titleopenSUSE Security Update : python-lxml (openSUSE-SU-2014:0735-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2941.NASL
    descriptionIt was discovered that clean_html() function of lxml (pythonic bindings for the libxml2 and libxslt libraries) performed insufficient sanitisation for some non-printable characters. This could lead to cross-site scripting.
    last seen2020-03-17
    modified2014-06-03
    plugin id74277
    published2014-06-03
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74277
    titleDebian DSA-2941-1 : lxml - security update
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2217-1.NASL
    descriptionIt was discovered that the lxml.html.clean module incorrectly stripped control characters. An attacked could potentially exploit this to conduct cross-site scripting (XSS) attacks. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id74136
    published2014-05-22
    reporterUbuntu Security Notice (C) 2014-2019 Canonical, Inc. / NASL script (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74136
    titleUbuntu 12.04 LTS / 13.10 / 14.04 LTS : lxml vulnerability (USN-2217-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_PYTHON-LXML-141001.NASL
    descriptionThis security update for python-lxml fixes a input sanitization flaw in clean_html. (CVE-2014-3146)
    last seen2020-06-05
    modified2014-10-11
    plugin id78254
    published2014-10-11
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/78254
    titleSuSE 11.3 Security Update : python-lxml (SAT Patch Number 9821)

References