CVE-2022-28367 Security Details

CVE ID

CVE-2022-28367

CWE

CWE-79

CVE Description

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

Published

Apr 22, 2022

CVSS Score & Severity

6.1Medium

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

0.962%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/owasp/validator/html/scan/AntiSamyDOMScanner.processStyleTag(Lorg/w3c/dom/Element;Lorg/w3c/dom/Node;)Z

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · ReleaseEVIDENCE

GitHub · PR #162PROJECT