CVE-2021-35043: XSS
First published: Mon Jul 19 2021(Updated: )
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Antisamy Project Antisamy | <1.6.4 | |
| Oracle Retail Back Office | =14.0 | |
| Oracle Retail Back Office | =14.1 | |
| Oracle Retail Central Office | =14.0 | |
| Oracle Retail Central Office | =14.1 | |
| Oracle Retail Returns Management | =14.0 | |
| Oracle Retail Returns Management | =14.1 | |
| Oracle Banking Enterprise Default Management | =2.6.2 | |
| Oracle Banking Enterprise Default Management | =2.7.0 | |
| Oracle Banking Enterprise Default Management | =2.7.1 | |
| Oracle Banking Enterprise Default Management | =2.10.0 | |
| Oracle Banking Enterprise Default Management | =2.12.0 | |
| Oracle Banking Enterprise Default Managment | >=2.3.0<=2.4.0 | |
| Oracle Banking Party Management | =2.7.0 | |
| Oracle Banking Platform | >=2.3.0<=2.4.1 | |
| Oracle Banking Platform | =2.6.2 | |
| Oracle Banking Platform | =2.7.0 | |
| Oracle Banking Platform | =2.7.1 | |
| Oracle Insurance Policy Administration | =11.0.2 | |
| Oracle Insurance Policy Administration | =11.1.0 | |
| Oracle Insurance Policy Administration | =11.2.8 | |
| Oracle Insurance Policy Administration | =11.3.0 | |
| Oracle Insurance Policy Administration | =11.3.1 | |
| Oracle Middleware Common Libraries And Tools | =12.2.1.3.0 | |
| Oracle Middleware Common Libraries And Tools | =12.2.1.4.0 | |
| Netapp Active Iq Unified Manager Linux | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| maven/org.owasp.antisamy:antisamy | >=1.5.7<1.6.4 | 1.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nahsra/antisamy/pull/87
- https://github.com/nahsra/antisamy/releases/tag/v1.6.4
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-35043
- https://github.com/advisories/GHSA-9c8w-jrw3-q2c3 (Advisory)
Frequently Asked Questions
What is CVE-2021-35043?
CVE-2021-35043 is a vulnerability in OWASP AntiSamy before 1.6.4 that allows XSS via HTML attributes when using the HTML output serializer.
How does CVE-2021-35043 affect Antisamy Project Antisamy?
Antisamy Project Antisamy versions up to exclusive 1.6.4 are affected by CVE-2021-35043.
Which Oracle products are affected by CVE-2021-35043?
Oracle Retail Back Office versions 14.0 and 14.1, Oracle Retail Central Office versions 14.0 and 14.1, Oracle Retail Returns Management versions 14.0 and 14.1, Oracle Banking Enterprise Default Management versions 2.6.2, 2.7.0, 2.7.1, 2.10.0, and 2.12.0, Oracle Banking Enterprise Default Management versions between inclusive 2.3.0 and 2.4.0, Oracle Banking Party Management version 2.7.0, Oracle Banking Platform versions between inclusive 2.3.0 and 2.4.1, Oracle Insurance Policy Administration versions 11.0.2, 11.1.0, 11.2.8, 11.3.0, and 11.3.1, and Oracle Middleware Common Libraries And Tools versions 12.2.1.3.0 and 12.2.1.4.0 are affected by CVE-2021-35043.
What is the severity of CVE-2021-35043?
CVE-2021-35043 has a severity value of 6.1, which is categorized as medium.
How can I fix CVE-2021-35043?
To fix CVE-2021-35043, update to OWASP AntiSamy version 1.6.4 or newer.
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/remedy
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9c8w-jrw3-q2c3
- alias/CVE-2021-35043
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/antisamy project
- canonical/antisamy project antisamy
- vendor/oracle
- canonical/oracle retail back office
- version/oracle retail back office/14.0
- version/oracle retail back office/14.1
- canonical/oracle retail central office
- version/oracle retail central office/14.0
- version/oracle retail central office/14.1
- canonical/oracle retail returns management
- version/oracle retail returns management/14.0
- version/oracle retail returns management/14.1
- canonical/oracle banking enterprise default management
- version/oracle banking enterprise default management/2.6.2
- version/oracle banking enterprise default management/2.7.0
- version/oracle banking enterprise default management/2.7.1
- version/oracle banking enterprise default management/2.10.0
- version/oracle banking enterprise default management/2.12.0
- canonical/oracle banking enterprise default managment
- version/oracle banking enterprise default managment/2.3.0
- version/oracle banking enterprise default managment/2.4.0
- canonical/oracle banking party management
- version/oracle banking party management/2.7.0
- canonical/oracle banking platform
- version/oracle banking platform/2.3.0
- version/oracle banking platform/2.4.1
- version/oracle banking platform/2.6.2
- version/oracle banking platform/2.7.0
- version/oracle banking platform/2.7.1
- canonical/oracle insurance policy administration
- version/oracle insurance policy administration/11.0.2
- version/oracle insurance policy administration/11.1.0
- version/oracle insurance policy administration/11.2.8
- version/oracle insurance policy administration/11.3.0
- version/oracle insurance policy administration/11.3.1
- canonical/oracle middleware common libraries and tools
- version/oracle middleware common libraries and tools/12.2.1.3.0
- version/oracle middleware common libraries and tools/12.2.1.4.0
- vendor/netapp
- canonical/netapp active iq unified manager linux
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- package-manager/maven