Vulnerability Details : CVE-2022-28366
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
Vulnerability category: Denial of service
Products affected by CVE-2022-28366
- cpe:2.3:a:antisamy_project:antisamy:*:*:*:*:*:*:*:*
- cpe:2.3:a:cyberneko_html_project:cyberneko_html:*:*:*:*:*:*:*:*
- cpe:2.3:a:htmlunit:htmlunit:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-28366
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 21 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-28366
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
References for CVE-2022-28366
-
https://github.com/nahsra/antisamy/releases/tag/v1.6.6
Release Release version 1.6.6 · nahsra/antisamy · GitHubRelease Notes;Third Party Advisory
-
https://search.maven.org/artifact/net.sourceforge.htmlunit/neko-htmlunit
net.sourceforge.htmlunit : neko-htmlunit - Maven Central Repository SearchRelease Notes;Third Party Advisory
-
https://sourceforge.net/projects/htmlunit/files/htmlunit/2.27/
HtmlUnit - Browse /htmlunit/2.27 at SourceForge.netRelease Notes;Third Party Advisory
Jump to