CVE-2022-28367

Опубликовано: 21 апр. 2022

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

Ссылки

https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
Patch
Third Party Advisory
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
Patch
Release Notes
Third Party Advisory
https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
Patch
Third Party Advisory
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
Patch
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:*

Версия до 1.6.6 (исключая)

EPSS

Процентиль: 60%

0.00995

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2022-28367

CVSS3: 6.1

ubuntu

больше 4 лет назад

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

CVE-2022-28367

CVSS3: 6.1

debian

больше 4 лет назад

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE ...

GHSA-3pqg-4rqg-pg9g

CVSS3: 6.1

github

больше 4 лет назад

Cross-site Scripting in OWASP AntiSamy

EPSS

Процентиль: 60%

0.00995

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79