CVE-2022-24891mediumCWE-79

CVE-2022-24891: falha de média gravidade em esapi-java-legacy

Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar esapi-java-legacy+ Monitorar org.owasp.esapi:esapi

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 1.7%
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
ESAPI · esapi-java-legacy
CVEs relacionadas — esapi-java-legacy

No mesmo produto, das mais perigosas para as menos.

CVE-2025-5878MEDIUMESAPI esapi-java-legacy SQL Injection Defense Encoder.encodeForSQL special elementEPSS 0.5%