Cross-site scripting in jsoup - CVE-2022-36033

Vulnerability identifier: #VU66756

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2022-36033

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of HTML code within the jsoup cleaner, including javascript: URL expressions when the non-default SafeList.preserveRelativeLinks option is enabled. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

jsoup
IBM Observability with Instana
Oracle Financial Services Model Management and Governance
Oracle Middleware Common Libraries and Tools
Oracle Enterprise Data Quality
Middleware Common Libraries and Tools
Oracle Banking Trade Finance
Oracle Banking Treasury Management
Oracle Communications EAGLE Element Management System
Migration Toolkit for Runtimes
IBM Cloud Transformation Advisor
IBM Maximo Asset Management
Maximo Manage Application in IBM Maximo Application Suite
IBM Maximo Application Suite
Amazon Linux AMI
Oracle Solaris Cluster
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
openEuler
IBM Data Risk Manager
Oracle Financial Services Crime and Compliance Management Studio
Oracle Business Process Management Suite
Oracle Banking Trade Finance Process Management
Oracle Banking Liquidity Management
Oracle Banking Branch
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Origination
Oracle Banking Corporate Lending Process Management
Oracle Banking Virtual Account Management
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
Stream Analytics
JBoss Enterprise Application Platform
PeopleSoft Enterprise PeopleTools
Oracle Business Intelligence Enterprise Edition
Oracle FLEXCUBE Universal Banking
Oracle Financial Services Lending and Leasing
Oracle Banking Digital Experience
Oracle WebCenter Portal
Oracle FLEXCUBE Enterprise Limits and Collateral Management
Oracle Retail Customer Management and Segmentation Foundation
Oracle Communications Cloud Native Core Console
Primavera Unifier
eap7-jboss-cert-helper (Red Hat package)
eap7-insights-java-client (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
jsoup
jsoup-javadoc
eap7-jsoup (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-hibernate-validator (Red Hat package)
eap7-wildfly (Red Hat package)
IBM Qradar SIEM
Wildfly

Install updates from vendor's website.

jsoup - update to 1.15.3
IBM Data Risk Manager - update to 2.0.6.15
JBoss Enterprise Application Platform - update to 7.4.19
Oracle FLEXCUBE Universal Banking - update to 14.3.0
Oracle Financial Services Lending and Leasing - update to 14.8.0
Stream Analytics - update to 19.1.0.0.8
eap7-jboss-cert-helper (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
eap7-insights-java-client (Red Hat package) - addressed in versions 1.1.3-1.redhat_00001.1.el7eap, 1.1.3-1.redhat_00001.1.el8eap, 1.1.3-1.redhat_00001.1.el9eap
Migration Toolkit for Runtimes - update to 1.2.7
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.18-1.Final_redhat_00001.1.el7eap, 1.5.18-1.Final_redhat_00001.1.el8eap, 1.5.18-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-39.Final_redhat_00039.1.el7eap, 1.10.0-39.Final_redhat_00039.1.el8eap, 1.10.0-39.Final_redhat_00039.1.el9eap
jsoup - update to 1.13.1-9
jsoup - update to 1.14.2-2
jsoup - update to 1.15.3-150200.3.6.1
jsoup-javadoc - update to 1.15.3-150200.3.6.1
eap7-jsoup (Red Hat package) - addressed in versions 1.15.4-1.redhat_00003.1.el7eap, 1.15.4-1.redhat_00003.1.el8eap, 1.15.4-1.redhat_00003.1.el9eap
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.el8eap, 2.0.15-1.Final_redhat_00001.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-37.redhat_00015.1.el7eap, 2.7.1-37.redhat_00015.1.el8eap, 2.7.1-37.redhat_00015.1.el9eap
IBM Cloud Transformation Advisor - update to 3.3.1
eap7-hal-console (Red Hat package) - addressed in versions 3.3.24-1.Final_redhat_00001.1.el7eap, 3.3.24-1.Final_redhat_00001.1.el8eap, 3.3.24-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.55-1.Final_redhat_00001.1.el7eap, 4.0.55-1.Final_redhat_00001.1.el8eap, 4.0.55-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.12-1.Final_redhat_00001.1.el7eap, 5.4.12-1.Final_redhat_00001.1.el8eap, 5.4.12-1.Final_redhat_00001.1.el9eap
eap7-hibernate-validator (Red Hat package) - addressed in versions 6.0.23-2.SP1_redhat_00001.1.el7eap, 6.0.23-2.SP1_redhat_00001.1.el8eap, 6.0.23-2.SP1_redhat_00001.1.el9eap
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
eap7-wildfly (Red Hat package) - addressed in versions 7.4.19-1.GA_redhat_00002.1.el7eap, 7.4.19-1.GA_redhat_00002.1.el8eap, 7.4.19-1.GA_redhat_00002.1.el9eap
IBM Maximo Asset Management - addressed in versions 7.6.1.2.33, 7.6.1.3.8
Maximo Manage Application in IBM Maximo Application Suite - update to 8.4.5
IBM Maximo Application Suite - update to 8.8.5
Wildfly - update to 27.0.0

• https://github.com/jhy/jsoup/security/advisories/GHSA-gp7f-rwcx-9369

• Cross-site scripting in jsoup cleaner
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• SUSE update for jsoup
• Multiple vulnerabilities in WildFly
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in Oracle Financial Services Crime and Compliance Management Studio
• Cross-site scripting in IBM Maximo Manage application in IBM Maximo Application Suite
• Multiple vulnerabilities in Oracle WebCenter Portal
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle FLEXCUBE Universal Banking
• Multiple vulnerabilities in Oracle Banking Treasury Management
• Multiple vulnerabilities in Oracle Banking Trade Finance
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Primavera Unifier
• Multiple vulnerabilities in Oracle Retail Customer Management and Segmentation Foundation
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Cross-site scripting in IBM Maximo Asset Management
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Cross-site scripting in Oracle FLEXCUBE Enterprise Limits and Collateral Management
• Multiple vulnerabilities in Oracle Banking Electronic Data Exchange for Corporates
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Financial Services Lending and Leasing
• openEuler update for jsoup
• Multiple vulnerabilities in Oracle Solaris Cluster
• Multiple vulnerabilities in Oracle Communications EAGLE Element Management System
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Amazon Linux AMI update for jsoup
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools