Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2022-24891 EUVD-2022-1809GHSA-q77q-vx4q-xx6q

Cross-site Scripting in org.owasp.esapi:esapi -- antisamy-esapi.xml configuration file

Published Apr 27, 2022 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: ESAPI Product: esapi-java-legacy Package: libowasp-esapi-java Package: libowasp-esapi-java Package: org.owasp.esapi:esapi Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

Affected products

VendorProductAffectedFixed
ESAPI esapi-java-legacy <= 2.2.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 libowasp-esapi-java 2.4.0.0-1 —
Debian 12 libowasp-esapi-java 2.4.0.0-1 —
Debian 11 libowasp-esapi-java 2.4.0.0-0+deb11u1 DLA-4246-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS libowasp-esapi-java 2.2.3.1-1ubuntu0.1~esm1 —
Ubuntu Pro 20.04 LTS libowasp-esapi-java 2.1.0-3ubuntu0.20.04.1~esm1 —
Ubuntu Pro 18.04 LTS libowasp-esapi-java 2.1.0-3ubuntu0.18.04.1~esm1 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS libowasp-esapi-java 2.1.0-2ubuntu0.1~esm1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.owasp.esapi:esapi < 2.3.0.0 2.3.0.0 GHSA-q77q-vx4q-xx6q

Advisories 2

References