VDB-107122 · CVE-2017-14735 · BID 105656

OWASP AntiSamy up to 1.5.7 HTML5 Entities javascript: URL cross site scripting

A vulnerability has been found in OWASP AntiSamy up to 1.5.7 and classified as problematic. This vulnerability affects an unknown functionality of the component HTML5 Entities Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Field	09/26/2017 09:33 AM	11/19/2019 03:47 PM	01/14/2021 12:55 PM
vendor	OWASP	OWASP	OWASP
name	AntiSamy	AntiSamy	AntiSamy
version	<=1.5.7	<=1.5.7	<=1.5.7
component	HTML5 Entities Handler	HTML5 Entities Handler	HTML5 Entities Handler
input_type	javascript: URL	javascript: URL	javascript: URL
cwe	79 (cross site scripting)	79 (cross site scripting)	79 (cross site scripting)
risk	1	1	1
cvss2_vuldb_basescore	4.3	4.3	4.3
cvss2_vuldb_tempscore	3.9	3.9	3.9
cvss2_vuldb_av	N	N	N
cvss2_vuldb_ac	M	M	M
cvss2_vuldb_au	N	N	N
cvss2_vuldb_ci	N	N	N
cvss2_vuldb_ii	P	P	P
cvss2_vuldb_ai	N	N	N
cvss2_nvd_av	N	N	N
cvss2_nvd_ac	M	M	M
cvss2_nvd_au	N	N	N
cvss2_nvd_ci	N	N	N
cvss2_nvd_ii	P	P	P
cvss2_nvd_ai	N	N	N
cvss3_meta_basescore	5.2	5.2	5.2
cvss3_meta_tempscore	4.8	4.8	4.8
cvss3_vuldb_basescore	4.3	4.3	4.3
cvss3_vuldb_tempscore	4.0	4.0	4.0
cvss3_vuldb_av	N	N	N
cvss3_vuldb_ac	L	L	L
cvss3_vuldb_pr	N	N	N
cvss3_vuldb_ui	R	R	R
cvss3_vuldb_s	U	U	U
cvss3_vuldb_c	N	N	N
cvss3_vuldb_i	L	L	L
cvss3_vuldb_a	N	N	N
cvss3_nvd_av	N	N	N
cvss3_nvd_ac	L	L	L
cvss3_nvd_pr	N	N	N
cvss3_nvd_ui	R	R	R
cvss3_nvd_s	C	C	C
cvss3_nvd_c	L	L	L
cvss3_nvd_i	L	L	L
cvss3_nvd_a	N	N	N
date	1506297600 (09/25/2017)	1506297600 (09/25/2017)	1506297600 (09/25/2017)
location	GitHub Repository	GitHub Repository	GitHub Repository
url	https://github.com/nahsra/antisamy/issues/10	https://github.com/nahsra/antisamy/issues/10	https://github.com/nahsra/antisamy/issues/10
price_0day	$0-$5k	$0-$5k	$0-$5k
cve	CVE-2017-14735	CVE-2017-14735	CVE-2017-14735
cve_assigned	1506297600	1506297600	1506297600
cve_nvd_published	1506297600	1506297600	1506297600
cve_nvd_summary	OWASP AntiSamy through 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.	OWASP AntiSamy through 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.	OWASP AntiSamy through 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.
securityfocus_title	OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability	OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability	OWASP AntiSamy CVE-2017-14735 Cross Site Scripting Vulnerability
seealso	90449 91385 91680 91681 91682 91683 93098 93251 93252 93253 93254 93255 93256 93257 93258 93259 93260 94364 94366 94365 94367 94368 94370 94369 94371 94372 94374 94373 94375 94376	90449 91385 91680 91681 91682 91683 93098 93251 93252 93253 93254 93255 93256 93257 93258 93259 93260 94364 94366 94365 94367 94368 94370 94369 94371 94372 94374 94373 94375 94376	90449 91385 91680 91681 91682 91683 93098 93251 93252 93253 93254 93255 93256 93257 93258 93259 93260 94364 94366 94365 94367 94368 94370 94369 94371 94372 94374 94373 94375 94376
cvss2_vuldb_e	ND	ND	ND
cvss2_vuldb_rl	ND	ND	ND
cvss2_vuldb_rc	UC	UC	UC
cvss3_vuldb_e	X	X	X
cvss3_vuldb_rl	X	X	X
cvss3_vuldb_rc	U	U	U
0day_days	81	81	81
cvss3_nvd_basescore	6.1	6.1	6.1
discoverydate		1499299200	1499299200
confirm_url		http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
securityfocus		105656	105656
securityfocus_date		1506297600 (09/25/2017)	1506297600 (09/25/2017)
securityfocus_class		Input Validation Error	Input Validation Error
person_name			Raj Veerappan
cvss2_nvd_basescore			4.3

◂ Previous Overview Next ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!