CVE-2010-4183 HTML Purifier cross-site scripting (XSS) vulnerability
MediumCVSS 4.3
EPSS 0.90%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ezyang/htmlpurifier(Packagist) | < 4.1.0 | 4.1.0 |
| debian/php-htmlpurifier(Debian:12) | < 4.1.1+dfsg1-1 | 4.1.1+dfsg1-1 |
| debian/php-htmlpurifier(Debian:14) | < 4.1.1+dfsg1-1 | 4.1.1+dfsg1-1 |
| htmlpurifier | <= 4.0.0 | No fix listed |
| htmlpurifier | = 1.0.0 | No fix listed |
| htmlpurifier | = 1.0.0-beta | No fix listed |
| htmlpurifier | = 1.0.1 | No fix listed |
| htmlpurifier | = 1.1.0 | No fix listed |
| htmlpurifier | = 1.1.1 | No fix listed |
| htmlpurifier | = 1.1.2 | No fix listed |
| htmlpurifier | = 1.2.0 | No fix listed |
| htmlpurifier | = 1.3.0 | No fix listed |
| htmlpurifier | = 1.3.1 | No fix listed |
| htmlpurifier | = 1.3.2 | No fix listed |
| htmlpurifier | = 1.4.0 | No fix listed |
| htmlpurifier | = 1.4.1 | No fix listed |
| htmlpurifier | = 1.5.0 | No fix listed |
| htmlpurifier | = 1.6.0 | No fix listed |
| htmlpurifier | = 1.6.1 | No fix listed |
| htmlpurifier | = 2.0.0 | No fix listed |
| htmlpurifier | = 2.0.1 | No fix listed |
| htmlpurifier | = 2.1.0 | No fix listed |
| htmlpurifier | = 2.1.1 | No fix listed |
| htmlpurifier | = 2.1.2 | No fix listed |
| htmlpurifier | = 2.1.3 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| htmlpurifier | = 2.1.4 | No fix listed |
| htmlpurifier | = 2.1.5 | No fix listed |
| htmlpurifier | = 3.0.0 | No fix listed |
| htmlpurifier | = 3.1.0 | No fix listed |
| htmlpurifier | = 3.1.0-rc1 | No fix listed |
| htmlpurifier | = 3.1.1 | No fix listed |
| htmlpurifier | = 3.2.0 | No fix listed |
| htmlpurifier | = 3.3.0 | No fix listed |
| htmlpurifier | = 4.0.0 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 3.3.0-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0+dfsg1-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0-2 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.1.0+dfsg1-1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com product
- htmlpurifier.org vendor-advisory
- htmlpurifier.org
- Debian Security Tracker CVE-2010-4183 vendor-advisory
- github.com