HTML Purifier Cross-site Scripting (XSS) vulnerability
Date: 2022-05
Affected: composer/ezyang/htmlpurifier
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2010-2479
CVE-2010-4183
CWE: CWE-79

Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Mitigations:

Architectural layers (MAESTRO):