CVE-2022-29577

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2022-04-21

Last modified

2026-10-08

Weaknesses

CWE-79

Affected products

• Antisamy (Antisamy Project)
• Enterprise Manager Base Platform (Oracle)
• Weblogic Server (Oracle)

References

• https://github.com/nahsra/antisamy/releases/tag/v1.6.7
• https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0
• https://www.oracle.com/security-alerts/cpujul2022.html