Select your cookie preferences

We use cookies and similar tools to enhance your experience, provide our services, deliver relevant advertising, and make improvements. Approved third parties also use these tools to help us deliver advertising and provide certain site features.

CVE-2024-22195

Public on 2024-01-11
Modified on 2024-02-12
Description

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Severity
Medium
See what this means
CVSS v3 Base Score
5.4
See breakdown
Continue reading

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 2 - Core python-jinja2 2024-02-01 19:57 ALAS2-2024-2436
Amazon Linux 2023 python-jinja2 2024-02-01 17:56 ALAS2023-2024-503
Amazon Linux 2 - Core python3-jinja2 2024-02-01 19:57 ALAS2-2024-2437

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD CVSSv3 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

Red Hat: CVE-2024-22195 Mitre: CVE-2024-22195 FAQs regarding Amazon Linux ALAS/CVE Severity