CVE-2021-35043 - CVE House
Back to Database
Status published Medium CVE-2021-35043

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when...

Vulnerability Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-35043

Credits & Attribution

No credits recorded in the NVD database.

References

More from antisamy project

View All →
CVE-2022-29577
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling...
Medium 6.1
CVE-2022-28367
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling...
Medium 6.1
CVE-2017-14735
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as...
Medium 6.1
CVE-2016-10006
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted...
Medium 6.1

Affected Vendor

antisamy project

View all reports →

Affected Software

antisamy, retail back office, retail central office, retail returns management, banking enterprise default management, banking enterprise default managment, banking party management, banking platform, insurance policy administration, middleware common libraries and tools, active iq unified manager
Vulnerable Versions:
0, 14.0, 14.1, 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0, 2.3.0, 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1, 12.2.1.3.0, 12.2.1.4.0

Timeline

Official Publish: July 19th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.