VULNERABILITY INTELLIGENCE

CVE-2022-28367

CVSS score6.1 MEDIUM

EPSS probability1.01%

CISA KEVNot currently listed

Published2022-04-21

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

cve@mitre.org — Patch, Third Party Advisory
cve@mitre.org — Patch, Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory