CVE-2022-24891 – org.owasp.esapi:esapi

Package

Manager: maven
Name: org.owasp.esapi:esapi
Vulnerable Version: >=0 <2.3.0.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00285 pctl0.51451

Details

Cross-site Scripting in org.owasp.esapi:esapi ### Impact There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details. ### Patches Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below. ### Workarounds Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below. ### References [Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf) ### For more information If you have any questions or comments about this advisory: * Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders". * Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.

Metadata

Created: 2022-04-27T21:09:46Z
Modified: 2022-05-10T15:44:45Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-q77q-vx4q-xx6q/GHSA-q77q-vx4q-xx6q.json
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-q77q-vx4q-xx6q
Finding: F008
Auto approve: 1