Critical severity · published Jan 13, 2021
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Json-sanitizer · Owasp
before 1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23899
Patch
https://github.com/OWASP/json-sanitizer/commit/a37f594f7378a1c76b3283e0dab9e1ab1dc0247e
Patch
https://github.com/OWASP/json-sanitizer/compare/v1.2.1...v1.2.2
Third Party Advisory
https://groups.google.com/g/json-sanitizer-support/c/dAW1AeNMoA0
More from Json-sanitizer
7.5
CVE-2021-23900
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input
6.1
CVE-2020-13973
OWASP json-sanitizer before 1.2.1 allows XSS