CVE-2022-28367 json
Cross-site Scripting in OWASP AntiSamy
published 2022-04-21 4 y ago modified 2026-06-17 4 mo ago also GHSA-3pqg-4rqg-pg9g , EUVD-2022-1609
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Patch / fix
- maven org.owasp.antisamy:antisamy 1.6.6
- antisamy_project antisamy 1.6.6
- libowasp-antisamy-java Debian 14, Debian 13 1.7.4-1
debian advisories DEBIAN-CVE-2022-28367
Exploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.owasp.antisamy:antisamy | <1.6.6 |
1.6.6 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/nahsra/antisamy/commit/0199e7e194dba5e7d7197703f43ebe22401e61ae
web, patch, third-party-advisory
-
github.com
/nahsra/antisamy/releases/tag/v1.6.6
web, patch, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-28367
advisory
-
github.com
/nahsra/antisamy
package
Sources
- CVE List CVE-2022-28367
- GitHub Advisory GHSA-3pqg-4rqg-pg9g
- NVD CVE-2022-28367
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.