NetSight
IP …
medium6.1

CVE-2021-35043

Cross-site Scripting in OWASP AntiSamy

Impact

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.owasp.antisamy:antisamy>= 1.5.7, < 1.6.41.6.4

Affected products

VendorProductAffected versions
Antisamy ProjectAntisamy
before 1.6.4
OracleRetail Back Office
Versions 14.0, 14.1
OracleRetail Central Office
Versions 14.0, 14.1
OracleRetail Returns Management
Versions 14.0, 14.1
OracleBanking Enterprise Default Management
Versions 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
OracleBanking Enterprise Default Managment
from 2.3.0 through 2.4.0
OracleBanking Party Management
Version 2.7.0
OracleBanking Platform
from 2.3.0 through 2.4.1
Versions 2.6.2, 2.7.0, 2.7.1
OracleInsurance Policy Administration
Versions 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1
OracleMiddleware Common Libraries And Tools
Versions 12.2.1.3.0, 12.2.1.4.0
NetappActive Iq Unified Manager
All versions

Weakness classification

CWE-79

References