Critical severity · published Oct 18, 2021
CVE-2021-42575
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements
9.8
CVSS
3%
EPSS
No
On KEV
Description
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JH
Java Html Sanitizer · Owasp
before 20211018.2 · source: NVD
MC
Middleware Common Libraries And Tools · Oracle
12.2.1.3.0; 12.2.1.4.0 · source: NVD
PU
Primavera Unifier · Oracle
17.7 through 17.12; 18.8; 19.12; 20.12; 21.12 · source: NVD
Affected product
MC
Middleware Common Libraries And Tools
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-42575
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-42575
Exploit
https://docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/
Patch
https://www.oracle.com/security-alerts/cpujan2022.html
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Middleware Common Libraries And Tools
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.1
CVE-2021-23926
The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input
8.8
CVE-2022-23307
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw
8.8
CVE-2022-23302
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration…
7.5
CVE-2021-42340
The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak