VDB

CVE-2021-35043

CVE-2021-35043 PUBLISHED CVSS 6.099999904632568 MEDIUM

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

EPSS 1.51% · 74.4th percentile

Risk Scores

CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
1.51%
74.4th percentile

Affected Products

VendorProductVersions
Ubuntu:24.04:LTSlibowasp-antisamy-java0, 1.7.4-1, 1.5.3+dfsg-1.1
Ubuntu:22.04:LTSlibowasp-antisamy-java1.5.3+dfsg-1.1, 0
Ubuntu:16.04:LTSlibowasp-antisamy-java1.5.3+dfsg-1, 0
Ubuntu:20.04:LTSlibowasp-antisamy-java0, 1.5.3+dfsg-1
Ubuntu:18.04:LTSlibowasp-antisamy-java0, 1.5.3+dfsg-1
Ubuntu:25.10libowasp-antisamy-java1.7.4-1, 0

Timeline

  • Jul 19, 2021 CVE Published
  • Jul 20, 2021 EPSS Score
  • Sep 18, 2021 EPSS Score
  • Nov 17, 2021 EPSS Score
  • Jan 16, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 8, 2022 EPSS Score
  • Mar 18, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jul 17, 2022 EPSS Score
  • Sep 15, 2022 EPSS Score
  • Nov 14, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›