CVE-2022-29577

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-21 · updated 2026-10-08
Weakness: CWE-79

Description

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.

Affected products

nahsra antisamy: before 1.6.7 — fixed in 1.6.7
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

How to fix

Upgrade to a fixed version: nahsra antisamy 1.6.7. Check the vendor advisory for mitigations.

References

https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0
https://github.com/nahsra/antisamy/releases/tag/v1.6.7
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/nahsra/antisamy/commit/32e273507da0e964b58c50fd8a4c94c9d9363af0
https://github.com/nahsra/antisamy/releases/tag/v1.6.7
https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2022-29577 or the next vulnerability affects your stack