GitHub Advisoryadvisory · Maven
GHSA-683w-6h9j-57wq OWASP AntiSamy vulnerable to Cross-site Scripting
MEDIUM
Official page ↗
- Aliases
- CVE-2016-10006
- Ecosystem
- Maven
- Packages
- org.owasp.antisamy:antisamy
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-06-16
Affected packages
• Maven org.owasp.antisamy:antisamy: < 1.5.5 → fixed in 1.5.5
Description
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Related
Alias · CVE (1)
- CVE-2016-10006 In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-10006 advisory
- https://github.com/nahsra/antisamy/issues/2 web
- https://github.com/nahsra/antisamy package
- https://web.archive.org/web/20170214025813/http://www.securityfocus.com/bid/95101 web
- https://web.archive.org/web/20201207192053/http://www.securitytracker.com/id/1037532 web