CVE-2022-24891

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

• CWE-79

• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdfExploit, Mitigation, Third Party Advisory
• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txtRelease Notes
• https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6qThird Party Advisory
• https://security.netapp.com/advisory/ntap-20230127-0014/Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdfExploit, Mitigation, Third Party Advisory
• https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/esapi4java-core-2.3.0.0-release-notes.txtRelease Notes
• https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6qThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00010.html
• https://security.netapp.com/advisory/ntap-20230127-0014/Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Apr 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24886Nextcloud Android app is the Android client for Nextcloud, a…3.8
• CVE-2022-24887Nextcloud Talk is a video and audio conferencing app for Nex…6.1
• CVE-2022-24888Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-24889Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-2489A vulnerability was found in SourceCodester Simple E-Learnin…8.8
• CVE-2022-24890Nextcloud Talk is a video and audio conferencing app for Nex…4.3
• CVE-2022-24892Shopware is an open source e-commerce software platform. Sta…7.5
• CVE-2022-24893ESP-IDF is the official development framework for Espressif …8.8
• CVE-2022-24894Symfony is a PHP framework for web and console applications …8.8
• CVE-2022-24895Symfony is a PHP framework for web and console applications …8.8
• CVE-2022-24896Tuleap is a Free & Open Source Suite to manage software deve…4.3
• CVE-2022-24897APIs to evaluate content with Velocity is a package for APIs…7.5