What is GHSA-3pqg-4rqg-pg9g?

GHSA-3pqg-4rqg-pg9g is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in OWASP AntiSamy

Which CVE IDs does GHSA-3pqg-4rqg-pg9g cover?

GHSA-3pqg-4rqg-pg9g covers the following CVE IDs: CVE-2022-28367. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3pqg-4rqg-pg9g?

GHSA-3pqg-4rqg-pg9g has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-3pqg-4rqg-pg9g?

GHSA-3pqg-4rqg-pg9g affects 1 product, including: maven/org.owasp.antisamy:antisamy:\u003c 1.6.6.

GHSA-3pqg-4rqg-pg9gMediumCVSS 6.1

Cross-site Scripting in OWASP AntiSamy

Vendor

GitHub Security Advisories

Published

April 23, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-28367 →

📋 Description

OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

🎯 Affected products1

maven/org.owasp.antisamy:antisamy:< 1.6.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-28367
https://github.com/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
https://github.com/advisories/GHSA-3pqg-4rqg-pg9g