CVE-2017-14735 — Cross-site Scripting in Project Antisamy

CWE-79 — Cross-site Scripting10 documents6 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 28.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Antisamy Project Antisamy
Timeline
PublishedSep 25
Latest updateJul 15

Description

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

4
OSV
OWASP AntiSamy Cross-site Scripting vulnerability↗2018-10-18
▶
GHSA
OWASP AntiSamy Cross-site Scripting vulnerability↗2018-10-18
▶
OSV
CVE-2017-14735: OWASP AntiSamy before 1↗2017-09-25
▶
CVEList
CVE-2017-14735: OWASP AntiSamy before 1↗2017-09-25
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: UI Framework (AntiSamy) — CVE-2017-14735↗2021-07-15
▶
Oracle
Oracle Oracle E-Business Suite Risk Matrix: Attachments, iRecruitment, Contracts (AntiSamy) — CVE-2017-14735↗2021-04-15
▶
Oracle
Oracle Oracle Knowledge Risk Matrix: Web Applications - InfoCenter (AntiSamy) — CVE-2017-14735↗2020-04-15
▶
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Load Testing for Web Apps (AntiSamy) — CVE-2017-14735↗2020-01-15
▶
Debian
CVE-2017-14735: libowasp-antisamy-java - OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by us...↗2017
▶
CVE-2017-14735 — Cross-site Scripting | cvebase