CVE-2011-4457: Infoleak
Published Nov 17, 2011
·Updated
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
Affected Software
6 affected componentsFixes available
maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer<88
88
Owasp-java-html-sanitizer Project Owasp-java-html-sanitizer<=83
Owasp-java-html-sanitizer Project Owasp-java-html-sanitizer=42
Owasp-java-html-sanitizer Project Owasp-java-html-sanitizer=48
Owasp-java-html-sanitizer Project Owasp-java-html-sanitizer=50
Owasp-java-html-sanitizer Project Owasp-java-html-sanitizer=74
Remediation
Event History
Nov 17, 2011
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·05:36 AM
Frequently Asked Questions
1
What is the severity of CVE-2011-4457?
CVE-2011-4457 is classified as a medium severity vulnerability.
2
How do I fix CVE-2011-4457?
To fix CVE-2011-4457, upgrade OWASP HTML Sanitizer to version 88 or later.
3
What types of attacks are possible with CVE-2011-4457?
CVE-2011-4457 allows user-assisted remote attackers to extract potentially sensitive information through crafted FORM elements.
4
Which versions of OWASP HTML Sanitizer are affected by CVE-2011-4457?
CVE-2011-4457 affects versions of OWASP HTML Sanitizer prior to version 88.
5
Does CVE-2011-4457 affect JavaScript functionality?
CVE-2011-4457 can be exploited even when JavaScript is disabled in the browser.