Skip to content

CVE-2017-14735 OWASP AntiSamy Cross-site Scripting vulnerability

MediumCVSS 6.1 EPSS 1.7%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Affected products

ProductAffected versionsFixed in
org.owasp.antisamy/antisamy(Maven) < 1.5.7 1.5.7
debian/libowasp-antisamy-java(Debian:12) All versions No fix listed
debian/libowasp-antisamy-java(Debian:14) < 1.7.4-1 1.7.4-1
debian/libowasp-antisamy-java(Debian:13) < 1.7.4-1 1.7.4-1
org.owasp.antisamy/antisamy(Maven) = 1.4.2 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.4.3 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.4.4 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.4.5 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5.1 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5.2 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5.3 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5.5 No fix listed
org.owasp.antisamy/antisamy(Maven) = 1.5.6 No fix listed
debian/libowasp-antisamy-java(Debian:12) = 1.5.3+dfsg-1.1 No fix listed
debian/libowasp-antisamy-java(Debian:12) = 1.7.4-1 No fix listed
antisamy project antisamy < 1.5.7 1.5.7
ubuntu/libowasp-antisamy-java(Ubuntu:24.04) All versions No fix listed
ubuntu/libowasp-antisamy-java(Ubuntu:26.04) All versions No fix listed
ubuntu/libowasp-antisamy-java(Ubuntu:26.10) All versions No fix listed
ubuntu/libowasp-antisamy-java(Ubuntu:22.04) All versions No fix listed

References