CVE-2022-29577CWE-79cross-site-scripting

CVE-2022-29577

Medium · published April 22, 2022

CVSS v3.1

6.1

EPSS

Percentile

70.8

In the wild

Unconfirmed

What it is

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.01328 · 70.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2022-04-22T03:15Z

Affected products (6)

Product	Versions	Fixed in
antisamy_project/antisamy	< 1.6.7	1.6.7
oracle/enterprise_manager_base_platform	all versions	—
oracle/enterprise_manager_base_platform	all versions	—
oracle/weblogic_server	all versions	—
oracle/weblogic_server	all versions	—
oracle/weblogic_server	all versions	—

References (6)

https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 · [email protected]https://github.com/nahsra/antisamy/releases/tag/v1.6.7 · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 · af854a3a-2127-422b-91ae-364da2661108 https://github.com/nahsra/antisamy/releases/tag/v1.6.7 · af854a3a-2127-422b-91ae-364da2661108 https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

21 APR 22:42Z
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input
cvelistv5