CVE-2022-24891
Summary
| CVE | CVE-2022-24891 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-04-27 21:15:00 UTC |
| Updated | 2023-06-23 19:33:00 UTC |
| Description | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Oncommand Workflow Automation | - | All | All | All |
| Application | Oracle | Weblogic Server | 12.2.1.3.0 | All | All | All |
| Application | Oracle | Weblogic Server | 12.2.1.4.0 | All | All | All |
| Application | Oracle | Weblogic Server | 14.1.1.0.0 | All | All | All |
| Application | Owasp | Enterprise Security Api | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file · Advisory · ESAPI/esapi-java-legacy · GitHub | CONFIRM | github.com | |
| esapi-java-legacy/esapi4java-core-2.3.0.0-release-notes.txt at develop · ESAPI/esapi-java-legacy · GitHub | MISC | github.com | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| esapi-java-legacy/ESAPI-security-bulletin8.pdf at develop · ESAPI/esapi-java-legacy · GitHub | MISC | github.com | |
| April 2022 OWASP Enterprise Security API Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 183437 Debian Security Update for libowasp-esapi-java (CVE-2022-24891)