Описание
Arbitrary code injection in json-sanitizer
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Пакеты
Наименование
com.mikesamuel:json-sanitizer
maven
Затронутые версииВерсия исправления
< 1.2.2
1.2.2
Связанные уязвимости
CVSS3: 9.8
nvd
около 5 лет назад
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.