vulnerability
Amazon Linux 2023: CVE-2023-3978: Medium priority package update for nerdctl (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:N/AC:M/Au:N/C:P/I:P/A:N) | Aug 2, 2023 | Feb 17, 2025 | Dec 4, 2025 |
Severity
6
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:N)
Published
Aug 2, 2023
Added
Feb 17, 2025
Modified
Dec 4, 2025
Description
Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
A flaw was found in the Golang HTML package where it is vulnerable to Cross-site scripting caused by the improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's web browser within the security context of the hosting website once the URL is clicked. The flaw allows an attacker to steal the victim's cookie-based authentication credentials.
A flaw was found in the Golang HTML package where it is vulnerable to Cross-site scripting caused by the improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's web browser within the security context of the hosting website once the URL is clicked. The flaw allows an attacker to steal the victim's cookie-based authentication credentials.
Solutions
amazon-linux-2023-upgrade-amazon-ssm-agentamazon-linux-2023-upgrade-amazon-ssm-agent-debuginfoamazon-linux-2023-upgrade-amazon-ssm-agent-debugsourceamazon-linux-2023-upgrade-ecs-initamazon-linux-2023-upgrade-nerdctl
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.