CVE-2022-24891: Netapp Active Iq Unified Manager

Medium severity, CVSS 6.1. EPSS: 1.7% chance of exploitation in the next 30 days.

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.

Affected products

• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Oracle WebLogic Server: version 12.2.1.3.0 only; version 12.2.1.4.0 only; version 14.1.1.0.0 only
• Owasp Enterprise Security API: before 2.3.0.0 (fixed in 2.3.0.0)

Published 2022-04-27. Last modified 2026-06-17.