GHSA-VP37-2F9P-3VR3 Cross-site Scripting in OWASP AntiSamy

🗓️ 23 Apr 2022 00:03:04Reported by GoogleType

osv

osv🔗 osv.dev👁 5 Views

XSS in OWASP AntiSamy via STYLE smuggling; CSS not encoded, incomplete CVE 2022 28367 fix.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: There are several vulnerabilities in AntiSamy used by IBM Maximo Asset Management (CVE-2022-28367, CVE-2022-29577)	5 Jun 202313:43	–	ibm
IBM Security Bulletins	Security Bulletin: There are several vulnerabilities in AntiSamy used by BM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-28367, CVE-2022-29577)	24 Mar 202321:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities (CVE-2022-48195, CVE-2022-29577, CVE-2022-28367)	17 Oct 202400:30	–	ibm
ATTACKERKB	CVE-2022-29577	21 Apr 202223:15	–	attackerkb
BDU FSTEC	The vulnerability of the library for performing fast, customizable HTML AntiSamy cleanup is related to incorrect encoding of the content in cascading style tables. This allows attackers to perform cross-site scripting attacks.	14 Nov 202200:00	–	bdu_fstec
Circl	CVE-2022-29577	22 Apr 202202:27	–	circl
CNNVD	OWASP AntiSamy 跨站脚本漏洞	21 Apr 202200:00	–	cnnvd
CVE	CVE-2022-29577	21 Apr 202222:42	–	cve
Cvelist	CVE-2022-29577	21 Apr 202222:42	–	cvelist
Debian CVE	CVE-2022-29577	21 Apr 202222:42	–	debiancve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29577
github	www.github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0
github	www.github.com/nahsra/antisamy
github	www.github.com/nahsra/antisamy/releases/tag/v1.6.7
oracle	www.oracle.com/security-alerts/cpujul2022.html

08 Nov 2023 04:09Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.1

EPSS0.01239

Cross site scripting STYLE smuggling CSS encoding CVE 2022 28367 OWASP AntiSamy