CVE-2022-29577

Katalog CVE

CVSS 6.1 · Medium EPSS 1,3%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada antisamy project antisamy, oracle enterprise manager base platform +1 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Rincian

Terbit di NVD

21 April 2022

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 70,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 patch
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
• https://github.com/nahsra/antisamy/releases/tag/v1.6.7 release notes