CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-35043
Medium (6.1). EPSS 1.5% chance of exploitation in the next 30 days. Fixed in org.owasp.antisamy:antisamy 1.6.4.
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- antisamy_project:antisamy
- netapp:active_iq_unified_manager
- oracle:banking_enterprise_default_management
- oracle:banking_enterprise_default_managment
- oracle:banking_party_management
- oracle:banking_platform
- oracle:insurance_policy_administration
- oracle:middleware_common_libraries_and_tools
- oracle:retail_back_office
- oracle:retail_central_office
- oracle:retail_returns_management
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9c8w-jrw3-q2c3 | Maven | org.owasp.antisamy:antisamy | >=1.5.7 <1.6.4 | 1.6.4 |