The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies…
Priority MEDIUM 47CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Why it matters now
EPSS 0.02975 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven): 20211018.1Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) | before 20211018.1 | 20211018.1 | Patch available | GHSA-3w73-fmf3-hg5c |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) Vendor— Affected before 20211018.1 Fixed in 20211018.1 Patch available GHSA-3w73-fmf3-hg5c
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:owasp:java_html_sanitizer:*:*:*:*:*:*:*:* | before 20211018.2 | Vulnerable | owasp-modsecurity |
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* | 21.12 | Vulnerable | Oracle |
- cpe:2.3:a:owasp:java_html_sanitizer:*:*:*:*:*:*:*:* Versions before 20211018.2 Vulnerable ·owasp-modsecurity
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:* Versions 21.12 Vulnerable ·Oracle
Remediation
- Fix · GHSA-3w73-fmf3-hg5c com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer (Maven) Fixed in 20211018.1 Advisory →
Red Hat 4 advisories
- RHSA-2022:7417 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update
- Red Hat Single Sign-On 7.6.1
- RHSA-2022:7411 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-1-5.el9sso, rh-sso7-javapackages-filesystem-6.0.0-7.el9sso, rh-sso7-javapackages-tools-6.0.0-7.el9sso +4
- RHSA-2022:7410 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el8sso
Show 1 more Red Hat advisories
- RHSA-2022:7409 Released 2022-11-03 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.1 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el7sso
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2022:7409 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2022:7410 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2022:7411 |
| Red Hat Single Sign-On 7.6.1 | Fixed | RHSA-2022:7417 |
Not affected: 1 product
- Red Hat Single Sign-On 7.6 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42575
- 2026-10-03 Alias added: GHSA-3w73-fmf3-hg5c
References
Patch 2
Sources
- CVE-2021-42575 · CVE Program
- CVE-2021-42575 · NVD
- FIRST EPSS
- GHSA-3w73-fmf3-hg5c · GitHub Advisory Database · CC BY 4.0
- CVE-2021-42575 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences