OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.owasp.antisamy:antisamy(Maven) | 1.5.7 | 1.6.4 | N/A |
CVSS Metrics
