Medium severity6.1NVD Advisory· Published Jul 19, 2021· Updated Jun 17, 2026
CVE-2021-35043
CVE-2021-35043
Description
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.owasp.antisamy:antisamyMaven | >= 1.5.7, < 1.6.4 | 1.6.4 |
Affected products
30cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*+ 2 more
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:*Range: >=2.3.0,<=2.4.0
- cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*range: >=2.3.0,<=2.4.1
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*
- OWASP/AntiSamydescription
Patches
Vulnerability mechanics
References
8- github.com/nahsra/antisamy/pull/87nvdPatchThird Party AdvisoryWEB
- github.com/nahsra/antisamy/releases/tag/v1.6.4nvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuapr2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpujan2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpujul2022.htmlnvdPatchThird Party AdvisoryWEB
- www.oracle.com/security-alerts/cpuoct2021.htmlnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-9c8w-jrw3-q2c3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-35043ghsaADVISORY
News mentions
0No linked articles in our index yet.