PT-2022-5409 · Owasp · Owasp Antisamy

Published 2022-04-10 · Updated 2023-02-23 · CVE-2022-29577

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OWASP AntiSamy versions prior to 1.6.7

Description The issue is related to the incorrect encoding of Cascading Style Sheets (CSS) content, allowing for HTML tag smuggling on STYLE content with crafted input. This can lead to cross-site scripting (XSS) attacks. The problem exists due to an incomplete fix for a previous issue.

Recommendations For versions prior to 1.6.7, update to version 1.6.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of STYLE content to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06725

CVE-2022-29577

GHSA-VP37-2F9P-3VR3

Affected Products

Owasp Antisamy

References · 12

• https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0 · Patch
• https://osv.dev/vulnerability/CVE-2022-29577 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29577 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29577 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06725 · Security Note
• https://ubuntu.com/security/CVE-2022-29577 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29577 · Security Note
• https://osv.dev/vulnerability/GHSA-vp37-2f9p-3vr3 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://github.com/nahsra/antisamy/releases/tag/v1.6.7 · Note
• https://github.com/nahsra/antisamy · Note
• https://t.me/cibsecurity/41294 · Telegram Post