CVE-2017-14735

OWASP AntiSamy Cross-site Scripting vulnerability

6.1 MediumPublic exploitFix available

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.66%Unchanged since Apr 14, 2021

What each source reports

NVD Score used 6.1

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: CVE-2017-14735
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: CVE-2017-14735
Updated: 2026-11-02

EUVDEUVD-2018-0657 No score

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: EUVD-2018-0657
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q44v-xc3g-v7jq 6.1

OWASP AntiSamy Cross-site Scripting vulnerability

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: GHSA-q44v-xc3g-v7jq
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: CVE-2017-14735
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-14735 6.1

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: DEBIAN-CVE-2017-14735
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-q44v-xc3g-v7jq 6.1

OWASP AntiSamy Cross-site Scripting vulnerability

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: GHSA-q44v-xc3g-v7jq
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-14735 6.1

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.

Record: UBUNTU-CVE-2017-14735
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

antisamy project antisamy

Affected packages

Affected packages
Package	Affected	Fixed
`org.owasp.antisamy:antisamy` Maven	before 1.5.7	1.5.7
`libowasp-antisamy-java` Debian:12	All versions, plus listed versions 1.5.3+dfsg-1.11.7.4-1	None known
`libowasp-antisamy-java` Debian:13	before 1.7.4-1	1.7.4-1
`libowasp-antisamy-java` Debian:14	before 1.7.4-1	1.7.4-1
`org.owasp.antisamy:antisamy` Maven	before 1.5.7, plus listed versions 1.4.21.4.31.4.41.4.51.5 Show 5 moreShow less 1.5.11.5.21.5.31.5.51.5.6	1.5.7
`libowasp-antisamy-java` Ubuntu:16.04:LTS	All versions, plus listed versions 1.5.3+dfsg-1	None known
`libowasp-antisamy-java` Ubuntu:18.04:LTS	All versions, plus listed versions 1.5.3+dfsg-1	None known
`libowasp-antisamy-java` Ubuntu:20.04:LTS	All versions, plus listed versions 1.5.3+dfsg-1	None known
`libowasp-antisamy-java` Ubuntu:22.04:LTS	All versions, plus listed versions 1.5.3+dfsg-1.1	None known
`libowasp-antisamy-java` Ubuntu:24.04:LTS	All versions, plus listed versions 1.5.3+dfsg-1.11.7.4-1	None known
`libowasp-antisamy-java` Ubuntu:25.10	All versions, plus listed versions 1.7.4-1	None known
`libowasp-antisamy-java` Ubuntu:26.10	All versions, plus listed versions 1.7.4-1	None known
`libowasp-antisamy-java` Ubuntu:26.04:LTS	All versions, plus listed versions 1.7.4-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	shoucheng3/nahsra__antisamy_CVE-2017-14735_1-5-6	2025-08-20

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-14735 is a medium vulnerability (CVSS 6.1) in Antisamy Project Antisamy, published September 25, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in org.owasp.antisamy:antisamy 1.5.7.

References

Show 9 moreShow less