PT-2011-4956 · Owasp · Owasp Html Sanitizer

Published 2011-11-17 · Updated 2022-05-17 · CVE-2011-4457

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OWASP HTML Sanitizer versions prior to 88

Description The issue allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element when JavaScript is disabled.

Recommendations For versions prior to 88, update to version 88 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-4457

GHSA-PCM9-FP55-563V

Affected Products

Owasp Html Sanitizer

References · 8

• 🔥 https://github.com/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/docs/cve20114457.md · Exploit
• http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-4457 · Security Note
• https://osv.dev/vulnerability/GHSA-pcm9-fp55-563v · Vendor Advisory
• https://github.com/OWASP/java-html-sanitizer · Note
• https://github.com/OWASP/java-html-sanitizer/commit/2027d3df73f62eb30b7f08269f346989f03144bd · Note
• https://github.com/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/change_log.md?plain=1#L103 · Note
• http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html · Note