medium6.1

CVE-2022-24891

Cross-site Scripting in org.owasp.esapi:esapi

Impact

### Impact There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details. ### Patches Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below. ### Workarounds Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below. ### References [Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf) ### For more information If you have any questions or comments about this advisory: * Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders". * Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.owasp.esapi:esapi`	<= 2.2.3.1	2.3.0.0

Affected products

Vendor	Product	Affected versions
Owasp	Enterprise Security Api	before 2.3.0.0
Oracle	Weblogic Server	Versions 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Netapp	Active Iq Unified Manager	All versions
Netapp	Oncommand Workflow Automation	All versions

Weakness classification

CWE-79