CVE-2022-29577

Published: Apr 21, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Affected (6)

Products: Antisamy Project: Antisamy · Oracle: Enterprise Manager Base Platform, Weblogic Server

Antisamy Project

1 product

Antisamy

Oracle

2 products

Enterprise Manager Base Platform

Weblogic Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Antisamy Project Antisamy	Before 1.6.7

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Enterprise Manager Base Platform	Version 13.4.0.0
Oracle Enterprise Manager Base Platform	Version 13.5.0.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0
Oracle Weblogic Server	Version 14.1.1.0.0