CVE-2024-22199
Critical
Description
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks.
SeverityCritical
CVSS9.3
Exploit probability—
Product
Gofiber Django
PublishedJan 11, 2024
First seenJan 11, 2024
How to fix
Update
- gofiber django3.1.9 or later
- github.com/gofiber/template/django/v33.1.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gofiber django | v < 3.1.9 | 3.1.9 |
| github.com/gofiber/template/django/v3Go | v < 3.1.9 | 3.1.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.