CVE-2022-24891: 
Java vulnerability analysis and mitigation

ESAPI (The OWASP Enterprise Security API), a free and open source web application security control library, was found to contain a cross-site scripting vulnerability (CVE-2022-24891) prior to version 2.3.0.0. The vulnerability was caused by an incorrect regular expression for "onsiteURL" in the antisamy-esapi.xml configuration file that failed to properly sanitize "javascript:" URLs. This vulnerability has existed since at least ESAPI 1.4 and was patched in ESAPI 2.3.0.0 released on April 17, 2022 (GitHub Advisory).

The vulnerability stems from a malformed regular expression in the antisamy-esapi.xml configuration file that incorrectly validates the "onsiteURL" attribute. This allows URLs with the "javascript:" scheme to bypass sanitization controls. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating it is network exploitable with low attack complexity and requires user interaction (NetApp Advisory).

Successful exploitation of this vulnerability could lead to cross-site scripting attacks, potentially resulting in unauthorized disclosure of sensitive information and modification of data when a user interacts with maliciously crafted input (NetApp Advisory).

The vulnerability is exploitable over a network and requires user interaction. An attacker could potentially exploit this vulnerability by crafting malicious URLs using the "javascript:" scheme that would bypass the ESAPI sanitization controls (GitHub Advisory).

The vulnerability is patched in ESAPI version 2.3.0.0 and later. For users unable to upgrade immediately, a workaround is available by manually editing the antisamy-esapi.xml configuration file to correct the "onsiteURL" regular expression. Users should either update to the new configuration file provided in esapi-2.3.0.0-configuration.jar or modify their existing configuration according to the remediation instructions (GitHub Advisory).