{
  "cveId": "CVE-2022-28367",
  "url": "https://patchblox.com/security/cve/CVE-2022-28367",
  "summary": "CVE-2022-28367 is fixed in libowasp-antisamy-java on 1 platform, first by DEBIAN-CVE-2022-28367, released April 21, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libowasp-antisamy-java: OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input",
  "description": "OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.",
  "published": "2022-04-21T23:15:10Z",
  "severity": "medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.01006,
  "epssPercentile": 0.63211,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libowasp-antisamy-java",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.7.4-1",
      "fix": "DEBIAN-CVE-2022-28367",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-28367",
      "released": "2022-04-21T23:15:10Z"
    },
    {
      "platform": "linux",
      "product": "libowasp-antisamy-java",
      "release": "Debian 14",
      "fixedVersion": "1.7.4-1",
      "fix": "DEBIAN-CVE-2022-28367",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-28367",
      "released": "2022-04-21T23:15:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}