AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources.
    Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by     flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments`     directive must be enabled in your policy file and also allow for certain tags at the same time. As a     result, certain crafty inputs can result in elements in comment tags being interpreted as executable when     using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.
    (CVE-2023-43643)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources.
    Prior to version 1.7.4, there is a potential for a mutation XSS (mXSS) vulnerability in AntiSamy caused by
    flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments`
    directive must be enabled in your policy file and also allow for certain tags at the same time. As a
    result, certain crafty inputs can result in elements in comment tags being interpreted as executable when
    using AntiSamy's sanitized output. This issue has been patched in AntiSamy 1.7.4 and later.
    (CVE-2023-43643)

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2024 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (NekoHTML)). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2023-49093)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional     products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle WebLogic Server accessible data. (CVE-2024-20927)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle WebLogic Server accessible data. (CVE-2024-20931)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
226753	Linux Distros Unpatched Vulnerability : CVE-2023-43643	Nessus	Misc.	medium
417455	SCA: security update for org.owasp.antisamy:antisamy (GHSA-pcf2-gh6g-h5r2)	Tenable Cloud Security	SCA Checks	medium
417455	SCA: security update for org.owasp.antisamy:antisamy (GHSA-pcf2-gh6g-h5r2)	Tenable Self-Hosted Container Security	SCA Checks	medium
189176	Oracle WebLogic Server (January 2024 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-43643

medium

Tenable Plugins

medium

medium

medium

critical