CVE-2021-35043 Security Details

CVE ID

CVE-2021-35043

CWE

CWE-79

CVE Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Published

Jul 21, 2021

CVSS Score & Severity

6.1Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

1.513%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · ReleaseEVIDENCE

GitHub · PR #87PROJECT