6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
55.1%
There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for “onsiteURL” in the antisamy-esapi.xml configuration file that can cause URLs with the “javascript:” scheme to NOT be sanitized. See the reference below for full details.
Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below.
Manually edit your antisamy-esapi.xml configuration files to change the “onsiteURL” regular expression as per remediation instructions in the reference below.
If you have any questions or comments about this advisory:
CPE | Name | Operator | Version |
---|---|---|---|
org.owasp.esapi:esapi | le | 2.2.3.1 |
github.com/advisories/GHSA-q77q-vx4q-xx6q
github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf
github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txt
github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q
nvd.nist.gov/vuln/detail/CVE-2022-24891
security.netapp.com/advisory/ntap-20230127-0014/
www.oracle.com/security-alerts/cpujul2022.html
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.002 Low
EPSS
Percentile
55.1%