CVE-2022-28367: XSS
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libowasp-antisamy-javato a version that resolves this vulnerability.Fixed in 1.7.4-1Fixed in 1.7.8-1 - Upgrade
Upgrade
debian/libowasp-antisamy-javato a version that resolves this vulnerability.Fixed in 1.7.4-1
Event History
Frequently Asked Questions
What is CVE-2022-28367?
CVE-2022-28367 is a vulnerability in OWASP AntiSamy before version 1.6.6.
How does CVE-2022-28367 work?
CVE-2022-28367 allows XSS attacks through HTML tag smuggling on STYLE content with crafted input.
What is the severity of CVE-2022-28367?
The severity of CVE-2022-28367 is medium with a CVSS score of 6.1.
How can I fix CVE-2022-28367?
To fix CVE-2022-28367, upgrade to OWASP AntiSamy version 1.6.6 or later.
What is CWE-79?
CWE-79 is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities.