CVE-2011-4457: Infoleak
First published: Thu Nov 17 2011(Updated: )
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer | <88 | 88 |
| OWASP Java HTML Sanitizer | <=83 | |
| OWASP Java HTML Sanitizer | =42 | |
| OWASP Java HTML Sanitizer | =48 | |
| OWASP Java HTML Sanitizer | =50 | |
| OWASP Java HTML Sanitizer | =74 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html
- http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457
- https://nvd.nist.gov/vuln/detail/CVE-2011-4457
- https://github.com/OWASP/java-html-sanitizer/commit/2027d3df73f62eb30b7f08269f346989f03144bd
- https://github.com/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/change_log.md?plain=1#L103
- https://github.com/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/docs/cve20114457.md
- https://github.com/advisories/GHSA-pcm9-fp55-563v (Advisory)
Frequently Asked Questions
What is the severity of CVE-2011-4457?
CVE-2011-4457 is classified as a medium severity vulnerability.
How do I fix CVE-2011-4457?
To fix CVE-2011-4457, upgrade OWASP HTML Sanitizer to version 88 or later.
What types of attacks are possible with CVE-2011-4457?
CVE-2011-4457 allows user-assisted remote attackers to extract potentially sensitive information through crafted FORM elements.
Which versions of OWASP HTML Sanitizer are affected by CVE-2011-4457?
CVE-2011-4457 affects versions of OWASP HTML Sanitizer prior to version 88.
Does CVE-2011-4457 affect JavaScript functionality?
CVE-2011-4457 can be exploited even when JavaScript is disabled in the browser.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pcm9-fp55-563v
- alias/CVE-2011-4457
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-cve
- source/NVD
- package-manager/maven
- vendor/owasp-java-html-sanitizer project
- canonical/owasp java html sanitizer
- version/owasp java html sanitizer/83
- version/owasp java html sanitizer/42
- version/owasp java html sanitizer/48
- version/owasp java html sanitizer/50
- version/owasp java html sanitizer/74