CVE-2021-42575: oracle middleware_common_libraries_and_tools
Vulnerability summary
CVE-2021-42575 is a critical (CVSS 9.8) vulnerability in oracle middleware_common_libraries_and_tools. EPSS estimates a 2.97% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 3Timeline
- 18-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.97%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (docs.google.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle2 products
- middleware_common_libraries_and_tools12.2.1.3.0 | 12.2.1.4.0
- primavera_unifier≥ 17.7, ≤ 17.12 | 18.8 | 19.12 | 20.12 | 21.12
Com.googlecode.owasp-java-html-sanitizer1 product
- owasp-java-html-sanitizer< 20211018.1
Owasp1 product
- java_html_sanitizer< 20211018.2
3 vendors · 4 products
References
5 links- docs.google.com/document/d/11SoX296sMS0XoQiQbpxc5pNxSdbJKDJkm5BDv0zrX50/X Refsource MISCExploitThird Party Advisory
