OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled

低危 2.6CVE-2011-4457 · GHSA-pcm9-fp55-563v · Published 17/11/2011 · updated 16/06/2026

要点

CVE-2011-4457 是影响 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer, owasp-java-html-sanitizer (owasp-java-html-sanitizer project) 的低危 (CVSS 2.6)漏洞。
未来 30 天内被利用的概率（EPSS）：1.4%，高于 71.8% 的漏洞。
修复：升级到 88 或更高版本。

Package	Affected versions	Patched versions
com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven	`< 88`	`88`
owasp-java-html-sanitizer owasp-java-html-sanitizer_project	`= 42= 48= 50= 74≤ 83`	No fix yet

Description

OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2011-4457 · ADVISORY
OWASP/java-html-sanitizer commit 2027d3d · WEB
OWASP/java-html-sanitizer · PACKAGE
OWASP/java-html-sanitizer · WEB
OWASP/java-html-sanitizer · WEB
code.google.com/p/owasp-java-html-sanitizer/wiki/CVE20114457 · WEB
owasp-java-html-sanitizer.googlecode.com/svn/trunk/CHANGE_LOG.html · WEB

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

要点

CVE-2011-4457 是影响 com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer, owasp-java-html-sanitizer (owasp-java-html-sanitizer project) 的低危 (CVSS 2.6)漏洞。

未来 30 天内被利用的概率（EPSS）：1.4%，高于 71.8% 的漏洞。

修复：升级到 88 或更高版本。

Package

Affected versions

Patched versions

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer

Maven

< 88

88

owasp-java-html-sanitizer

owasp-java-html-sanitizer_project

= 42= 48= 50= 74≤ 83

No fix yet

Description

NVD description

com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 的其他漏洞

查看全部 →