CVE-2021-35043

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Published: Jul 19, 2021
Updated: May 9, 2024
CVE: CVE-2021-35043
GHSA: GHSA-9c8w-jrw3-q2c3
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
antisamy_project / antisamy	-	1.6.4
oracle / retail_back_office	14.1	14.1.x
oracle / retail_back_office	14.0	14.0.x
oracle / retail_returns_management	14.0	14.0.x
oracle / retail_returns_management	14.1	14.1.x
oracle / retail_central_office	14.0	14.0.x
oracle / retail_central_office	14.1	14.1.x
oracle / banking_platform	2.6.2	2.6.2.x
oracle / banking_platform	2.7.0	2.7.0.x
oracle / banking_platform	2.7.1	2.7.1.x
oracle / insurance_policy_administration	11.3.0	11.3.0.x
oracle / insurance_policy_administration	11.0.2	11.0.2.x
oracle / banking_enterprise_default_management	2.12.0	2.12.0.x
oracle / banking_enterprise_default_management	2.10.0	2.10.0.x
oracle / banking_party_management	2.7.0	2.7.0.x
oracle / banking_platform	2.3.0	2.4.1.x
oracle / banking_enterprise_default_managment	2.3.0	2.4.0.x
oracle / insurance_policy_administration	11.1.0	11.1.0.x
oracle / insurance_policy_administration	11.3.1	11.3.1.x
oracle / banking_enterprise_default_management	2.7.0	2.7.0.x
oracle / banking_enterprise_default_management	2.7.1	2.7.1.x
oracle / banking_enterprise_default_management	2.6.2	2.6.2.x
oracle / middleware_common_libraries_and_tools	12.2.1.4.0	12.2.1.4.0.x
oracle / insurance_policy_administration	11.2.8	11.2.8.x
oracle / middleware_common_libraries_and_tools	12.2.1.3.0	12.2.1.3.0.x
org.owasp.antisamy / antisamy	-	1.6.4

Vulnerability Database

289,599

CVE-2021-35043