CVE-2022-29577

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Published: Apr 22, 2022
Updated: May 9, 2024
CVE: CVE-2022-29577
GHSA: GHSA-vp37-2f9p-3vr3
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
antisamy_project / antisamy	-	1.6.7
oracle / weblogic_server	12.2.1.3.0	12.2.1.3.0.x
oracle / weblogic_server	12.2.1.4.0	12.2.1.4.0.x
oracle / weblogic_server	14.1.1.0.0	14.1.1.0.0.x
oracle / enterprise_manager_base_platform	13.4.0.0	13.4.0.0.x
oracle / enterprise_manager_base_platform	13.5.0.0	13.5.0.0.x
org.owasp.antisamy / antisamy	-	1.6.7

https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0
https://github.com/nahsra/antisamy/releases/tag/v1.6.7
https://www.oracle.com/security-alerts/cpujul2022.html

Vulnerability Database

289,599

CVE-2022-29577