CVE Vulnerabilities

CVE-2022-24891

Published: Apr 27, 2022 | Modified: Jun 23, 2023
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for onsiteURL in the antisamy-esapi.xml configuration file that can cause javascript: URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the antisamy-esapi.xml configuration files to change the onsiteURL regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers release notes and security bulletin.

Affected Software

Name Vendor Start Version End Version
Enterprise_security_api Owasp * *

References