CVE-2022-24891

mediumpriority · track · 35EPSS 0.017 · 77 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.71% (77th) EPSS

CVSS 4.3 · medium

Is it mine?

11 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

cvss

Technical severity, 0–10. One row per scoring source.

6.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 2.5

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV

v3.15.8mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

exploits (1)

Public proof-of-concept and weaponised exploit code.

shoucheng3/ESAPI__esapi-java-legacy_CVE-2022-24891_2-2-3-1shoucheng3/ESAPI__esapi-java-legacy_CVE-2022-24891_2-2-3-1PoC · poc_in_github

affected products (11)

Products and version ranges known to be affected.

NetApp ActiveIQ Unified Manager for Linuxall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_linux
NetApp ActiveIQ Unified Manager for Microsoft Windowsall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_microsoft_windows
NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
ESAPI esapi-java-legacy≤ ≤ 2.2.3.1enisa_euvdEU
netapp active iq unified managerall versionsnvdUScpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:*:*:*
netapp oncommand workflow automationall versionsnvdUScpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*
oracle weblogic server= 12.2.1.3.0nvdUScpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracle weblogic server= 12.2.1.4.0nvdUScpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
oracle weblogic server= 14.1.1.0.0nvdUScpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
owasp enterprise security api< 2.3.0.0nvdUScpe:2.3:a:owasp:enterprise_security_api:*:*:*:*:*:*:*:*
Maven org.owasp.esapi:esapi< 2.3.0.0osvUSpkg:maven/org.owasp.esapi/esapi

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0217NetApp ActiveIQ Unified Manager: Mehrere SchwachstellenDeutsch2023-01-29csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Cross-Site-Scripting-Angriff durchzuführen.
GHSA-q77q-vx4q-xx6qCross-site Scripting in org.owasp.esapi:esapi2022-04-27ghsa · osvUS
### Impact There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details. ### Patches Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below. ### Workarounds Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below. ### References [Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf) ### For more information If you have any questions or comments about this advisory: * Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders". * Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

published 2022-04-27modified 2026-06-17

references (19)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan