GitHub Advisoryadvisory · Maven

GHSA-3pqg-4rqg-pg9g Cross-site Scripting in OWASP AntiSamy

MEDIUM Published 2022-04-23 Modified 2022-05-04 Official page ↗
Aliases
CVE-2022-28367
Ecosystem
Maven
Packages
org.owasp.antisamy:antisamy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-04-26

Affected packages

• Maven org.owasp.antisamy:antisamy: < 1.6.6 → fixed in 1.6.6

Description

OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

Related

Alias · CVE (1)

  • CVE-2022-28367 OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References