CVE-2022-28367

EUVD-2022-1609
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
Affected Products (NVD)
VendorProductVersion
antisamy_projectantisamy
𝑥
< 1.6.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libowasp-antisamy-java
bookworm
ignored
bullseye
no-dsa
buster
no-dsa
sid
1.7.4-1
fixed
stretch
no-dsa
trixie
1.7.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libowasp-antisamy-java
bionic
needs-triage
focal
needs-triage
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
https://github.com/nahsra/antisamy/releases/tag/v1.6.6