[SLING-10852] Upgrade ESAPI to 2.2.3.0

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: XSS Protection API 2.2.16
• Component/s: XSS Protection API
• Assignee: Radu Cotescu
• Reporter: Arun Kumar Ram
• Created: 05/Oct/21 13:31
• Updated: 11/Oct/21 09:27
• Resolved: 05/Oct/21 16:15

Description

The esapi package is vulnerable to XML External Entity (XXE) attacks. The loadPropertiesFromFile() method in the XmlEsapiPropertyLoader class allows external entities to be defined in user-controlled XML input files that can be used to configured the application. A remote attacker with control over the input file used to configure the application may craft a malicious XML file that could lead to Denial of Service (DoS), and in certain circumstances Remote Code Execution (RCE)

Issue Links

• is a clone of: SLING-9616 Update to latest OWASP AntiSamy and ESAPI Java libraries
• links to: Github PR #11