TI-2021-14007 Aliases CVE-2021-35043 GHSA-9c8w-jrw3-q2c3

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output…

LOW 30CWE-79Published 2021-07-19 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.

Why it matters now

EPSS 0.01513 74th percentileScored 2026-11-07

Fix Partial org.owasp.antisamy:antisamy (Maven): 1.6.4Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.owasp.antisamy:antisamy (Maven)	1.5.7 to before 1.6.4	1.6.4	Patch available	GHSA-9c8w-jrw3-q2c3

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.owasp.antisamy:antisamy (Maven) Vendor— Affected 1.5.7 to before 1.6.4 Fixed in 1.6.4 Patch available GHSA-9c8w-jrw3-q2c3

CPE configurations NVD · 28

CPE	Versions	Role	Vendor
cpe:2.3:a:antisamy_project:antisamy::::::::	before 1.6.4	Vulnerable	Antisamy Project
cpe:2.3:a:oracle:retail_back_office:14.0:::::::*	14.0	Vulnerable	Oracle
cpe:2.3:a:oracle:retail_back_office:14.1:::::::*	14.1	Vulnerable	Oracle
cpe:2.3:a:oracle:retail_central_office:14.0:::::::*	14.0	Vulnerable	Oracle
cpe:2.3:a:oracle:retail_central_office:14.1:::::::*	14.1	Vulnerable	Oracle
cpe:2.3:a:oracle:retail_returns_management:14.0:::::::*	14.0	Vulnerable	Oracle
cpe:2.3:a:oracle:retail_returns_management:14.1:::::::*	14.1	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:::::::*	2.6.2	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:::::::*	2.7.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:::::::*	2.7.1	Vulnerable	Oracle

cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:* Versions before 1.6.4 Vulnerable ·Antisamy Project
cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle

Show 18 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:::::::*	2.10.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:::::::*	2.12.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_enterprise_default_managment::::::::	2.3.0 – 2.4.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:::::::*	2.7.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_platform::::::::	2.3.0 – 2.4.1	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_platform:2.6.2:::::::*	2.6.2	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_platform:2.7.0:::::::*	2.7.0	Vulnerable	Oracle
cpe:2.3:a:oracle:banking_platform:2.7.1:::::::*	2.7.1	Vulnerable	Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:::::::*	11.0.2	Vulnerable	Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:::::::*	11.1.0	Vulnerable	Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:::::::*	11.2.8	Vulnerable	Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:::::::*	11.3.0	Vulnerable	Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:::::::*	11.3.1	Vulnerable	Oracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:::::::*	12.2.1.3.0	Vulnerable	Oracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:::::::*	12.2.1.4.0	Vulnerable	Oracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::	not specified by NVD	Vulnerable	NetApp

cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:* Versions 2.3.0 – 2.4.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:* Versions 11.2.8 Vulnerable ·Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:* Versions 11.3.1 Vulnerable ·Oracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

Fix · GHSA-9c8w-jrw3-q2c3 org.owasp.antisamy:antisamy (Maven) Fixed in 1.6.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat JBoss Fuse 6	Affected	No fix planned: Out of support scope

Timeline

2026-10-02 Threatist record created from CVE-2021-35043
2026-10-03 Alias added: GHSA-9c8w-jrw3-q2c3

References

Patch 6

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-35043

Other 1

https://github.com/nahsra/antisamy

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences