by Kastro
Paper/Archive/CVE-2021-23899

CVE-2021-23899

mitre — OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.6.816 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2refgroups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0refgithub.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e