Описание
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libowasp-antisamy-java | fixed | 1.7.4-1 | package | |
| libowasp-antisamy-java | ignored | bookworm | package | |
| libowasp-antisamy-java | no-dsa | bullseye | package | |
| libowasp-antisamy-java | no-dsa | buster | package | |
| libowasp-antisamy-java | no-dsa | stretch | package |
Примечания
https://github.com/nahsra/antisamy/pull/87
Связанные уязвимости
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Уязвимость библиотеки для выполнения быстрой настраиваемой очистки HTML AntiSamy, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки