CVE-2022-28367: XSS
Published Apr 21, 2022
·Updated
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Affected Software
1 affected component
AntiSamy project AntiSamy<1.6.6
Remediation
Patch Available
Event History
Apr 21, 2022
CVE Published
via MITRE·10:42 PM
Data Sourced
via MITRE·10:42 PM
Description
Frequently Asked Questions
1
What is CVE-2022-28367?
CVE-2022-28367 is a vulnerability in OWASP AntiSamy before version 1.6.6.
2
How does CVE-2022-28367 work?
CVE-2022-28367 allows XSS attacks through HTML tag smuggling on STYLE content with crafted input.
3
What is the severity of CVE-2022-28367?
The severity of CVE-2022-28367 is medium with a CVSS score of 6.1.
4
How can I fix CVE-2022-28367?
To fix CVE-2022-28367, upgrade to OWASP AntiSamy version 1.6.6 or later.
5
What is CWE-79?
CWE-79 is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities.