CVE-2021-35043

MEDIUM

OWASP AntiSamy < 1.6.4 - Cross-Site Scripting via HTML Attribute Serialization

Title source: llm
STIX 2.1

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

References (6)

Core 6
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Patch, Third Party Advisory x_refsource_misc
https://github.com/nahsra/antisamy/releases/tag/v1.6.4
Patch, Third Party Advisory x_refsource_misc
https://github.com/nahsra/antisamy/pull/87
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2022.html

Scores

CVSS v3 6.1
EPSS 0.0047
EPSS Percentile 64.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (27)
antisamy_project/antisamy < 1.6.4
netapp/active_iq_unified_manager (3 CPE variants)
oracle/banking_enterprise_default_management 2.6.2
oracle/banking_enterprise_default_management 2.7.0
oracle/banking_enterprise_default_management 2.7.1
oracle/banking_enterprise_default_management 2.10.0
oracle/banking_enterprise_default_management 2.12.0
oracle/banking_enterprise_default_managment 2.3.0 - 2.4.0
oracle/banking_party_management 2.7.0
oracle/banking_platform 2.6.2
... and 17 more
Published Jul 19, 2021
Tracked Since Feb 18, 2026