Description

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Remediation

References

CVE-2022-29577

Related Vulnerabilities

WordPress Plugin post highlights Cross-Site Scripting (2.6)

MySQL CVE-2012-0119 Vulnerability (CVE-2012-0119)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-0325)

Django Incorrect Default Permissions Vulnerability (CVE-2020-24584)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-15161)

Severity

Medium

Classification

CVE-2022-29577 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities