CVE-2011-4457 json
OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled
published 2011-11-17 14 y ago modified 2026-06-16 4 mo ago also GHSA-pcm9-fp55-563v , EUVD-2022-4744
- cvss
- 2.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
Patch / fix
- maven com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer 88
Exploit prediction
1.37% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer | <88 |
88 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
code.google.com
/p/owasp-java-html-sanitizer/wiki/CVE20114457
web, patch
-
github.com
/OWASP/java-html-sanitizer/commit/2027d3df73f62eb30b7f08269f346989f03144bd
web
-
owasp-java-html-sanitizer.googlecode.com
/svn/trunk/CHANGE_LOG.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2011-4457
advisory
-
github.com
/OWASP/java-html-sanitizer
package
-
github.com
/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/change_log.md?plain=1#L103
web
-
github.com
/OWASP/java-html-sanitizer/blob/35c506cfd452dba634202f13a7cc2e2a63ad7ee0/docs/cve20114457.md
web
Sources
- CVE List CVE-2011-4457
- GitHub Advisory GHSA-pcm9-fp55-563v
- NVD CVE-2011-4457
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.