GitHub Advisoryadvisory · Maven

GHSA-vp37-2f9p-3vr3 Cross-site Scripting in OWASP AntiSamy

MEDIUM Published 2022-04-23 Modified 2022-05-04 Official page ↗
Aliases
CVE-2022-29577
Ecosystem
Maven
Packages
org.owasp.antisamy:antisamy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-04-26

Affected packages

• Maven org.owasp.antisamy:antisamy: < 1.6.7 → fixed in 1.6.7

Description

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Related

Alias · CVE (1)

  • CVE-2022-29577 OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References