CVE-2016-10006 — Cross-site Scripting in Project Antisamy

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.5%
top 32.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Antisamy Project Antisamy
Timeline
PublishedDec 24
Latest updateOct 18

Description

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
OWASP AntiSamy vulnerable to Cross-site Scripting↗2018-10-18
▶
OSV
OWASP AntiSamy vulnerable to Cross-site Scripting↗2018-10-18
▶
CVEList
CVE-2016-10006: In OWASP AntiSamy before 1↗2016-12-24
▶
OSV
CVE-2016-10006: In OWASP AntiSamy before 1↗2016-12-24
▶

📋Vendor Advisories

1
Debian
CVE-2016-10006: libowasp-antisamy-java - In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag t...↗2016
▶
CVE-2016-10006 — Cross-site Scripting | cvebase