CVE-2021-35043

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected)

published July 19, 2021

CVSS
—
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01513 · 74.3th percentile
Published
2021-07-19T14:53Z
EPSS history
Timeline
  • 19 JUL 14:53Z
    OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected)
    cvelistv5