CVE-2022-24891 Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

2022-04-2700:00:00

CWE-79

GitHub_M

www.cve.org

cross-site scripting

esapi

antisamy-esapi.xml

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

AI Score

7.5

Confidence

High

EPSS

0.002

Percentile

55.8%

JSON

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for “onsiteURL” in the antisamy-esapi.xml configuration file that can cause “javascript:” URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit theantisamy-esapi.xml configuration files to change the “onsiteURL” regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers’ release notes and security bulletin.

CNA Affected

[
  {
    "vendor": "ESAPI",
    "product": "esapi-java-legacy",
    "versions": [
      {
        "version": "<= 2.2.3.1",
        "status": "affected"
      }
    ]
  }
]