Skip to main content

Improper Neutralization of Special Elements

CVE-2025-5878

Medium
6.9/10

Summary

A vulnerability was found in ESAPI esapi-java-legacy prior to version 2.7.0.0 and classified as problematic. This issue affects the interface "Encoder.encodeForSQL" of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID "f75ac2c2647a81d2cfbdc9c899f8719c240ed512" is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID "e2322914304d9b1c52523ff24be495b7832f6a56" is updating the misleading Java class documentation to warn about the risks.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-138 - Improper Neutralization of Special Elements

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

References

Advisory Timeline

  • Published