CVE-2022-24891

EIP tracks 1 public exploit for CVE-2022-24891. PoCs published by shoucheng3.

AI-analyzed exploit summary This repository contains the OWASP ESAPI (Enterprise Security API) for Java (Legacy) project, which is a security control library. The README provides project details, release notes, and contribution guidelines but does not include exploit code or a proof-of-concept for CVE-2022-24891.

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.