CVE-2021-35043

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-19 · updated 2026-06-17
Weakness: CWE-79

Description

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Affected products

nahsra antisamy: before 1.6.4 — fixed in 1.6.4
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
Oracle Banking Enterprise Default Management: 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
Oracle Banking Enterprise Default Managment: from 2.3.0 through 2.4.0
Oracle Banking Party Management: 2.7.0
Oracle Banking Platform: from 2.3.0 through 2.4.1; 2.6.2, 2.7.0, 2.7.1
Oracle Insurance Policy Administration: 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1
Oracle Middleware Common Libraries And Tools: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Retail Back Office: 14.0, 14.1
Oracle Corporation Retail Central Office: 14.0, 14.1
Oracle Corporation Retail Returns Management: 14.0, 14.1

How to fix

Upgrade to a fixed version: nahsra antisamy 1.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-35043 or the next vulnerability affects your stack