GHSA-9c8w-jrw3-q2c3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-9c8w-jrw3-q2c3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-9c8w-jrw3-q2c3/GHSA-9c8w-jrw3-q2c3.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-9c8w-jrw3-q2c3
- Aliases
- Published
- 2021-08-02T16:58:43Z
- Modified
- 2024-05-15T07:03:29.054325Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Cross-site Scripting in OWASP AntiSamy
- Details
-
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Database specific
{ "nvd_published_at": "2021-07-19T15:15:00Z", "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed_at": "2021-07-19T21:38:51Z", "github_reviewed": true }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2021-35043
- https://github.com/nahsra/antisamy/pull/87
- https://github.com/nahsra/antisamy
- https://github.com/nahsra/antisamy/releases/tag/v1.6.4
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Affected packages
Maven / org.owasp.antisamy:antisamy
Package
- Name
- org.owasp.antisamy:antisamy
- View open source insights on deps.dev
- Purl
- pkg:maven/org.owasp.antisamy/antisamy