CVE-2011-4457

Published: Nov 17, 2011Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.

Affected (5)

Products: Owasp Java Html Sanitizer Project: Owasp Java Html Sanitizer

Owasp Java Html Sanitizer Project

1 product

Owasp Java Html Sanitizer

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Owasp Java Html Sanitizer Project Owasp Java Html Sanitizer	Up to 83
Owasp Java Html Sanitizer Project Owasp Java Html Sanitizer	Version 42
Owasp Java Html Sanitizer Project Owasp Java Html Sanitizer	Version 48
Owasp Java Html Sanitizer Project Owasp Java Html Sanitizer	Version 50
Owasp Java Html Sanitizer Project Owasp Java Html Sanitizer	Version 74

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457

Source: cve@mitre.org

Patch

http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html

Source: cve@mitre.org

http://code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.