CVE-2024-22195

EUVD-2024-0365
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
Affected Products (NVD)
VendorProductVersion
palletsprojectsjinja
𝑥
< 3.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
jinja2
bookworm
3.1.2-1+deb12u3
fixed
bullseye
vulnerable
bullseye (security)
2.11.3-1+deb11u4
fixed
forky
3.1.6-1
fixed
sid
3.1.6-1
fixed
trixie
3.1.6-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jinja2
bionic
Fixed 2.10-1ubuntu0.18.04.1+esm1
released
focal
Fixed 2.10.1-2ubuntu0.2
released
jammy
Fixed 3.0.3-1ubuntu0.1
released
lunar
ignored
mantic
Fixed 3.1.2-1ubuntu0.23.10.1
released
noble
Fixed 3.1.2-1ubuntu1
released
oracular
Fixed 3.1.2-1ubuntu1
released
plucky
Fixed 3.1.2-1ubuntu1
released
trusty
Fixed 2.7.2-2ubuntu0.1~esm2
released
xenial
Fixed 2.8-1ubuntu0.1+esm2
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python3-Jinja2
suse enterprise server 15 SP4
2.10.1-150000.3.13.1
fixed
python311-Jinja2
suse enterprise server 15 SP4
3.1.2-150400.12.6.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
fence-agents-aliyun
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-all
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-amt-ws
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-apc
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-apc-snmp
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-aws
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-azure-arm
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-bladecenter
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-brocade
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-cisco-mds
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-cisco-ucs
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-common
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-compute
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-drac5
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-eaton-snmp
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-emerson
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-eps
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-gce
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-heuristics-ping
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-hpblade
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ibm-powervs
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ibm-vpc
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ibmblade
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ifmib
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ilo-moonshot
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ilo-mp
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ilo-ssh
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ilo2
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-intelmodular
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ipdu
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-ipmilan
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-kdump
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-kubevirt
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-lpar
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-mpath
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-openstack
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-redfish
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-rhevm
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-rsa
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-rsb
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-sbd
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-scsi
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-virsh
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-vmware-rest
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-vmware-soap
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-wti
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-agents-zvm
RHEL 8
0:4.2.1-129.el8
fixed
RHEL 9
0:4.10.0-62.el9
fixed
fence-virt
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd-cpg
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd-libvirt
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd-multicast
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd-serial
RHEL 9
0:4.10.0-62.el9
fixed
fence-virtd-tcp
RHEL 9
0:4.10.0-62.el9
fixed
ha-cloud-support
RHEL 9
0:4.10.0-62.el9
fixed
python3-jinja2
RHEL 9
0:2.11.3-5.el9
fixed