Detections
Analytics
Linux Distros Unpatched Vulnerability : CVE-2022-24891
medium Nessus Plugin ID 224598
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.- ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for onsiteURL in the **antisamy-esapi.xml** configuration file that can cause javascript: URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the onsiteURL regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin. (CVE-2022-24891)
Note that Nessus relies on the presence of the package as reported by the vendor.
Solution
There is no known solution at this time.Plugin Details
Severity: Medium
ID: 224598
File Name: unpatched_CVE_2022_24891.nasl
Version: 1.1
Type: local
Agent: unix
Family: Misc.
Published: 3/5/2025
Updated: 3/5/2025
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS Score Source: CVE-2022-24891
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Required KB Items: Host/cpu, Host/local_checks_enabled, global_settings/vendor_unpatched
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 4/27/2022
Reference Information
CVE: CVE-2022-24891