GHSA-q77q-vx4q-xx6q

    Dashboard / Vulnerabilities / GHSA-q77q-vx4q-xx6q

    GHSA-q77q-vx4q-xx6q

    Published: 27 Apr 2022Last Modified: 3 Nov 2025

    Summary: Cross-site Scripting in org.owasp.esapi:esapi

    Details: ### Impact There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details. ### Patches Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below. ### Workarounds Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below. ### References [Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf) ### For more information If you have any questions or comments about this advisory: * Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders". * Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.

    References: https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q, https://nvd.nist.gov/vuln/detail/CVE-2022-24891, https://github.com/ESAPI/esapi-java-legacy, https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf, https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txt, https://lists.debian.org/debian-lts-announce/2025/07/msg00010.html, https://security.netapp.com/advisory/ntap-20230127-0014, https://www.oracle.com/security-alerts/cpujul2022.html

    Affected packages

    Package

    Name: org.owasp.esapi:esapi

    Purl: pkg:maven/org.owasp.esapi/esapi

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.3.0.0

    Affected versions

    2.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-q77q-vx4q-xx6q | CVE-DB