CVE-2021-42575: Oracle Middleware Common Libraries And Tools

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.

Affected products

• Oracle Middleware Common Libraries And Tools: version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only; version 21.12 only
• Owasp Java Html Sanitizer: before 20211018.2 (fixed in 20211018.2)

Published 2021-10-18. Last modified 2026-06-17.