Back Linuxsecurity

Ubuntu 24.04 LTS ESAPI Critical XSS Control-Flow Bypass USN-8181

Linuxsecurity •LinuxSecurity Advisories • April 16, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in ESAPI. Software Description: - libowasp-esapi-java: Web application security control library from OWASP Details: Jaroslav Loba\u010devski discovered that ESAPI incorrectly validated directory paths during path verification. An attacker could possibly use this issue to bypass directory validation checks, leading to control-flow bypass. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-23457) Kevin W. Wall and Sebastian Passaro discovered that ESAPI did not properly sanitize javascript URLs because of an incorrect regular expression. An attacker could possibly use this issue to perform a cross-site scripting attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libowasp-esapi-java 2.4.0.0-2ubuntu0.1 Ubuntu 22.04 LTS libowasp-esapi-java 2.2.3.1-1ubuntu0.1~esm1 Available with Ubuntu Pro libowasp-esapi-java-doc 2.2.3.1-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS libowasp-esapi-java 2.1.0-3ubuntu0.20.04.1~esm1 Available with Ubuntu Pro libowasp-esapi-java-doc 2.1.0-3ubuntu0.20.04.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libowasp-esapi-java 2.1.0-3ubuntu0.18.04.1~esm1 Available with Ubuntu Pro libowasp-esapi-java-doc 2.1.0-3ubuntu0.18.04.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libowasp-esapi-java 2.1.0-2ubuntu0.1~esm1 Available with Ubuntu Pro libowasp-esapi-java-doc 2.1.0-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2022-23457, CVE-2022-24891, CVE-2025-5878

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical ESAPI Vulnerabilities Affect Multiple Ubuntu Releases Recent vulnerabilities in the ESAPI library have been identified, impacting several versions of Ubuntu, including 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS. The vulnerabilities include a control-flow bypass due to improper directory path validation (CVE-2022-23457), cross-site scripting due to improper sanitization of JavaScript URLs (CVE-2022-24891), and SQL injection flaws (CVE-2025-5878). These issues could allow attackers to exploit the affected systems through various attack vectors, including bypassing directory validation and executing malicious scripts. Users are advised to update their systems to the latest package versions to mitigate these vulnerabilities. The vulnerabilities were discovered by researchers Jaroslav Lobačevski, Kevin W. Wall, Sebastian Passaro, and Longlong Gong. The patches for these vulnerabilities are available as part of standard system updates. The vulnerabilities primarily affect web applications utilizing the ESAPI library. 2 sources 71

Extracted Entities

Ubuntu 24.04 LTS ESAPI Critical XSS Control-Flow Bypass USN-8181

The full story

Extracted Entities

Companies (1)

CVEs (3)

CWE Weaknesses (2)

Vulnerabilities (1)