DNA View

CVE-2024-34064

Medium

Low Medium High Critical

5.4

CVSS Score

Published: May 06, 2024

Last Modified: Nov 03, 2025

CWE: CWE-79

Vulnerability Description

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.

CVSS Metrics

Common Vulnerability Scoring System

Vector String:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Known Affected Software

46 configuration(s) from 2 vendor(s)

fedora

Version:

CPE:

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

fedora

Version:

CPE:

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

jinja

Version:

2.8.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.8.1:*:*:*:*:*:*:*

jinja

Version:

2.9.6

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.6:*:*:*:*:*:*:*

jinja

Version:

2.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.3:*:*:*:*:*:*:*

jinja

Version:

2.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.1:*:*:*:*:*:*:*

jinja

Version:

3.0.0

CPE:

cpe:2.3:a:palletsprojects:jinja:3.0.0:-:*:*:*:*:*:*

jinja

Version:

2.10.2

CPE:

cpe:2.3:a:palletsprojects:jinja:2.10.2:*:*:*:*:*:*:*

jinja

Version:

2.10.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.10.3:*:*:*:*:*:*:*

jinja

Version:

2.11.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.11.1:*:*:*:*:*:*:*

jinja

Version:

2.2

CPE:

cpe:2.3:a:palletsprojects:jinja:2.2:*:*:*:*:*:*:*

jinja

Version:

2.7.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.7.3:*:*:*:*:*:*:*

jinja

Version:

2.9.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.1:*:*:*:*:*:*:*

jinja

Version:

2.5.4

CPE:

cpe:2.3:a:palletsprojects:jinja:2.5.4:*:*:*:*:*:*:*

jinja

Version:

2.5.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.5.1:*:*:*:*:*:*:*

jinja

Version:

2.11.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.11.3:*:*:*:*:*:*:*

jinja

Version:

2.9

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9:*:*:*:*:*:*:*

jinja

Version:

3.0.2

CPE:

cpe:2.3:a:palletsprojects:jinja:3.0.2:*:*:*:*:*:*:*

jinja

Version:

2.2.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.2.1:*:*:*:*:*:*:*

jinja

Version:

2.7.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.7.1:*:*:*:*:*:*:*

jinja

Version:

3.0.3

CPE:

cpe:2.3:a:palletsprojects:jinja:3.0.3:*:*:*:*:*:*:*

jinja

Version:

3.1.3

CPE:

cpe:2.3:a:palletsprojects:jinja:3.1.3:*:*:*:*:*:*:*

jinja

Version:

2.9.4

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.4:*:*:*:*:*:*:*

jinja

Version:

2.3.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.3.1:*:*:*:*:*:*:*

jinja

Version:

3.1.1

CPE:

cpe:2.3:a:palletsprojects:jinja:3.1.1:*:*:*:*:*:*:*

jinja

Version:

2.9.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.3:*:*:*:*:*:*:*

jinja

Version:

2.9.2

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.2:*:*:*:*:*:*:*

jinja

Version:

2.0

CPE:

cpe:2.3:a:palletsprojects:jinja:2.0:-:*:*:*:*:*:*

jinja

Version:

3.0.1

CPE:

cpe:2.3:a:palletsprojects:jinja:3.0.1:*:*:*:*:*:*:*

jinja

Version:

2.11.0

CPE:

cpe:2.3:a:palletsprojects:jinja:2.11.0:*:*:*:*:*:*:*

jinja

Version:

2.6

CPE:

cpe:2.3:a:palletsprojects:jinja:2.6:*:*:*:*:*:*:*

jinja

Version:

2.7.2

CPE:

cpe:2.3:a:palletsprojects:jinja:2.7.2:*:*:*:*:*:*:*

jinja

Version:

2.1.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.1.1:*:*:*:*:*:*:*

jinja

Version:

2.7

CPE:

cpe:2.3:a:palletsprojects:jinja:2.7:*:*:*:*:*:*:*

jinja

Version:

2.10.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.10.1:*:*:*:*:*:*:*

jinja

Version:

2.4.1

CPE:

cpe:2.3:a:palletsprojects:jinja:2.4.1:*:*:*:*:*:*:*

jinja

Version:

2.9.5

CPE:

cpe:2.3:a:palletsprojects:jinja:2.9.5:*:*:*:*:*:*:*

jinja

Version:

2.5.3

CPE:

cpe:2.3:a:palletsprojects:jinja:2.5.3:*:*:*:*:*:*:*

jinja

Version:

2.11.2

CPE:

cpe:2.3:a:palletsprojects:jinja:2.11.2:*:*:*:*:*:*:*

jinja

Version:

3.1.0

CPE:

cpe:2.3:a:palletsprojects:jinja:3.1.0:*:*:*:*:*:*:*

jinja

Version:

2.8

CPE:

cpe:2.3:a:palletsprojects:jinja:2.8:*:*:*:*:*:*:*

jinja

Version:

2.5

CPE:

cpe:2.3:a:palletsprojects:jinja:2.5:*:*:*:*:*:*:*

jinja

Version:

3.1.2

CPE:

cpe:2.3:a:palletsprojects:jinja:3.1.2:*:*:*:*:*:*:*

jinja

Version:

2.5.5

CPE:

cpe:2.3:a:palletsprojects:jinja:2.5.5:*:*:*:*:*:*:*

jinja

Version:

2.10

CPE:

cpe:2.3:a:palletsprojects:jinja:2.10:*:*:*:*:*:*:*

jinja

Version:

Oracle Critical Patch Update Advisory - July 2025

Severity

Critical

Released

Jul 15, 2025

Restart Required

Security Update

View Details Vendor Page

Oracle

CPUAPR2025

Oracle Critical Patch Update Advisory - April 2025

Severity

Critical

Released

Apr 15, 2025

Restart Required

Security Update

View Details Vendor Page

Oracle

CPUJAN2025

Oracle Critical Patch Update Advisory - January 2025

Severity

Critical

Released

Jan 21, 2025

Restart Required

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

5.4

out of 10.0

Medium

Weakness Type (CWE)

CWE-79 Top 25 #1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Exploit Likelihood: High
Typical Severity: Medium
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base