Log in Start free

Vulnerability · Published Apr 27, 2022 · Assigned by GitHub_M

CVE-2022-24891Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

Medium 5.4

In plain English

A medium-severity cross-site scripting in esapi-java-legacy from ESAPI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libowasp-esapi-java2.4.0.0-1DEBIAN-CVE-2022-24891
Debian:13libowasp-esapi-java2.4.0.0-1DEBIAN-CVE-2022-24891
Mavenorg.owasp.esapi:esapi2.3.0.0GHSA-q77q-vx4q-xx6q

Affected products (as reported)

VendorProductVersions
ESAPI esapi-java-legacy <= 2.2.3.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References