Search for vulnerabilities
Vulnerability details: VCID-qujn-wrf7-aaaq
Vulnerability ID VCID-qujn-wrf7-aaaq
Aliases CVE-2023-3978
GHSA-2wrh-6pvc-2jm9
Summary Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2024:0485
ssvc Track https://access.redhat.com/errata/RHSA-2024:0485
cvssv3.1 7.7 https://access.redhat.com/errata/RHSA-2024:1891
ssvc Track https://access.redhat.com/errata/RHSA-2024:1891
cvssv3 6.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-3978.json
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00078 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00079 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00088 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.00619 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
epss 0.01546 https://api.first.org/data/v1/epss?cve=CVE-2023-3978
cvssv3.1 5.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.1 https://go.dev/cl/514896
generic_textual MODERATE https://go.dev/cl/514896
cvssv3.1 6.1 https://go.dev/issue/61615
generic_textual MODERATE https://go.dev/issue/61615
cvssv3 6.1 https://nvd.nist.gov/vuln/detail/CVE-2023-3978
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2023-3978
cvssv3.1 6.1 https://pkg.go.dev/vuln/GO-2023-1988
generic_textual MODERATE https://pkg.go.dev/vuln/GO-2023-1988
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-3978.json
https://api.first.org/data/v1/epss?cve=CVE-2023-3978
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3978
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://go.dev/cl/514896
https://go.dev/issue/61615
https://pkg.go.dev/vuln/GO-2023-1988
1043163 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1043163
2228689 https://bugzilla.redhat.com/show_bug.cgi?id=2228689
cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*
CVE-2023-3978 https://nvd.nist.gov/vuln/detail/CVE-2023-3978
RHSA-2023:5007 https://access.redhat.com/errata/RHSA-2023:5007
RHSA-2023:5009 https://access.redhat.com/errata/RHSA-2023:5009
RHSA-2023:5888 https://access.redhat.com/errata/RHSA-2023:5888
RHSA-2023:6031 https://access.redhat.com/errata/RHSA-2023:6031
RHSA-2023:6474 https://access.redhat.com/errata/RHSA-2023:6474
RHSA-2023:6832 https://access.redhat.com/errata/RHSA-2023:6832
RHSA-2023:6837 https://access.redhat.com/errata/RHSA-2023:6837
RHSA-2023:6938 https://access.redhat.com/errata/RHSA-2023:6938
RHSA-2023:6939 https://access.redhat.com/errata/RHSA-2023:6939
RHSA-2023:7197 https://access.redhat.com/errata/RHSA-2023:7197
RHSA-2023:7198 https://access.redhat.com/errata/RHSA-2023:7198
RHSA-2023:7216 https://access.redhat.com/errata/RHSA-2023:7216
RHSA-2023:7315 https://access.redhat.com/errata/RHSA-2023:7315
RHSA-2024:0485 https://access.redhat.com/errata/RHSA-2024:0485
RHSA-2024:0944 https://access.redhat.com/errata/RHSA-2024:0944
RHSA-2024:10523 https://access.redhat.com/errata/RHSA-2024:10523
RHSA-2024:1891 https://access.redhat.com/errata/RHSA-2024:1891
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2024:0485
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-17T14:09:02Z/ Found at https://access.redhat.com/errata/RHSA-2024:0485
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://access.redhat.com/errata/RHSA-2024:1891
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-26T14:01:04Z/ Found at https://access.redhat.com/errata/RHSA-2024:1891
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-3978.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://go.dev/cl/514896
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://go.dev/issue/61615
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-3978
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-3978
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://pkg.go.dev/vuln/GO-2023-1988
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.24341
EPSS Score 0.00078
Published At April 19, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.