CVE-2022-24891: Cross-site Scripting in org.owasp.esapi:esapi
Summary
CVE-2022-24891: Cross-site Scripting in org.owasp.esapi:esapi. Affects org.owasp.esapi:esapi versions < 2.3.0.0. Fixed in 2.3.0.0. How to fix ↓
Also tracked for
- libowasp-esapi-java · Debian:11
The same CVE-2022-24891 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.owasp.esapi:esapi package is a widely used library that provides security functions for Java applications. It offers protection against common web application vulnerabilities, including cross-site scripting (XSS) attacks. However, a vulnerability has been discovered in the library that could allow an attacker to execute malicious scripts on a victim's browser.
Vulnerability Detail
The vulnerability in org.owasp.esapi:esapi is due to an incorrect regular expression for the "onsiteURL" configuration in the antisamy-esapi.xml file. This flaw prevents the proper sanitization of URLs with the "javascript:" scheme, allowing an attacker to inject and execute arbitrary JavaScript code on a victim's browser. This could lead to various security risks, such as session hijacking, data theft, or defacement of web pages.
How To Fix
Latest published version: 2.7.0.1-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the library is not immediately feasible, a temporary workaround is to manually edit the antisamy-esapi.xml configuration file. The "onsiteURL" regular expression should be modified according to the remediation instructions provided in the reference. This will ensure that URLs with the "javascript:" scheme are properly sanitized and prevent the XSS vulnerability.
Conclusion
The org.owasp.esapi:esapi library is vulnerable to a cross-site scripting (XSS) attack due to an incorrect regular expression in the antisamy-esapi.xml configuration file. To mitigate this vulnerability, it is crucial to update the library to version 2.3.0.0 or later. Alternatively, developers can apply the provided workaround by manually modifying the configuration file. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.owasp.esapi:esapi →
FAQ
The vulnerability allows an attacker to execute malicious scripts on a victim's browser, potentially leading to various security risks such as session hijacking, data theft, or defacement of web pages.
To fix this vulnerability, update the org.owasp.esapi:esapi library to version 2.3.0.0 or later. Alternatively, manually edit the antisamy-esapi.xml configuration file as per the provided remediation instructions.
Yes, a temporary workaround is to manually edit the antisamy-esapi.xml configuration file and modify the "onsiteURL" regular expression. Refer to the remediation instructions for detailed steps.
There is no known public exploitation of this vulnerability at the time of this advisory. However, it is recommended to apply the necessary patches or workarounds to mitigate the risk.
For more information on org.owasp.esapi:esapi, you can visit the OWASP ESAPI wiki page or join the ESAPI related Google Groups. Details can be found in the provided references.
Related vulnerabilities
Recent vulnerabilities recorded for org.owasp.esapi:esapi.
