CVE-2011-4457 OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled
LowCVSS 2.6
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | < 88 | 88 |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = 1.1 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r136 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r156 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r163 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r164 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r173 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r198 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r209 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r223 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r232 | No fix listed |
| com.googlecode.owasp-java-html-sanitizer/owasp-java-html-sanitizer(Maven) | = r239 | No fix listed |
| owasp-java-html-sanitizer project owasp-java-html-sanitizer | <= 83 | No fix listed |
| owasp-java-html-sanitizer project owasp-java-html-sanitizer | = 42 | No fix listed |
| owasp-java-html-sanitizer project owasp-java-html-sanitizer | = 48 | No fix listed |
| owasp-java-html-sanitizer project owasp-java-html-sanitizer | = 50 | No fix listed |
| owasp-java-html-sanitizer project owasp-java-html-sanitizer | = 74 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- github.com
- github.com
- code.google.com patch
- owasp-java-html-sanitizer.googlecode.com
- github.com