CVE-2022-36033 jsoup
| Affected software | jsoup |
|---|---|
| Severity | 6.1 Medium CVSS 3.1 2 scores |
| Fixed in | 1.15.3 |
| Weakness | Cross-site scripting (CWE-79) |
| Published | 29 Aug 2022 |
| Updated | 13 Nov 2026 |
Description
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default SafeList.preserveRelativeLinks option is enabled, HTML including javascript: URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable SafeList.preserveRelativeLinks, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)
CWE-87
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: partial.
- Indexed PoC none indexed
- EPSS 1.6% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full XSS
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR XSS RULE. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: XSS RULE
How to mitigate CVE-2022-36033
Upgrade jsoup to 1.15.3 or later. Until you can, Waratek RASP blocks exploitation with its XSS rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
6.1 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2 metrics
CVSS
6.1 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
security-advisories@github.com | Secondary | published |
| CVSS 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Analytics / Platform Security (jsoup) (12.2.1.4.0) |
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Communications / Security (jsoup) (46.6.4, 46.6.5) |
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Systems / Tools (jsoup) (4) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Financial Services Applications / Base (jsoup) (14.5.0-14.7.0) Oracle Financial Services Applications / Common Core (jsoup) (14.5.0-14.7.0) Oracle Financial Services Applications / Infrastructure (jsoup) (14.5.0-14.7.0) Oracle Financial Services Applications / Internal Operations (jsoup) (14.5.0-14.7.0) Oracle Financial Services Applications / Reports (jsoup) (14.5.0-14.7.0) Oracle Financial Services Applications / Reports (jsoup) (14.5.0-14.7.0) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Financial Services Applications / Installer (jsoup) (8.1.2.3,8.1.2.4) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Financial Services Applications / Accessibility (jsoup) (14.7.0.2.0, 14.7.1.0.0) Oracle Financial Services Applications / Common (jsoup) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0) Oracle Financial Services Applications / Common (jsoup) (14.7.1.0.0) Oracle Financial Services Applications / Dashboard (jsoup) (14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0) Oracle Financial Services Applications / Onboarding Batch Processes (jsoup) (14.5-14.7) Oracle Financial Services Applications / Security (jsoup) (14.7.0.2.0, 14.7.1.0.0) Oracle Fusion Middleware / General (jsoup) (12.2.1.4.0) Oracle GoldenGate / Oracle GoldenGate Stream Analytics (jsoup) (19.1.0.0.0-19.1.0.0.7) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Construction and Engineering / User Interface (jsoup) (18.8.0-18.8.18, 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.14, 22.12.0-22.12.3) Oracle Financial Services Applications / Infrastructure (jsoup) (14.0-14.3, 14.5-14.7) Oracle Financial Services Applications / Infrastructure (jsoup) (14.5, 14.6, 14.7) Oracle Financial Services Applications / Infrastructure (jsoup) (14.5, 14.6, 14.7) Oracle Financial Services Applications / UI General (jsoup) (18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2) Oracle Fusion Middleware / Installer (jsoup) (12.2.1.4.0) Oracle Fusion Middleware / Security Framework (jsoup) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (jsoup) (12.2.1.4.0) Oracle PeopleSoft / Elastic Search (jsoup) (8.58, 8.59, 8.60) Oracle Retail Applications / Internal Operations (jsoup) (18.0.0.12, 19.0.0.6) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Financial Services Applications / Studio (jsoup) (8.0.8.3.1) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Installer (jsoup) (22.2.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Platform Security (jsoup) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Communications | Installer (jsoup) | 22.2.0 | 22.2.0 |
| Oracle Communications | Security (jsoup) | 46.6.4, 46.6.5 | 46.6.4 · 46.6.5 |
| Oracle Construction and Engineering | User Interface (jsoup) | 18.8.0-18.8.18, 19.12.0-19.12.16, 20.12.0-20.12.16, 21.12.0-21.12.14, 22.12.0-22.12.3 | |
| Oracle Financial Services Applications | Accessibility (jsoup) | 14.7.0.2.0, 14.7.1.0.0 | 14.7.0.2.0 · 14.7.1.0.0 |
| Oracle Financial Services Applications | Base (jsoup) | 14.5.0-14.7.0 | |
| Oracle Financial Services Applications | Common (jsoup) | 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 | 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0 |
| Oracle Financial Services Applications | Common Core (jsoup) | 14.5.0-14.7.0 | |
| Oracle Financial Services Applications | Dashboard (jsoup) | 14.5.0.8.0, 14.6.0.4.0, 14.7.0.2.0, 14.7.1.0.0 | 14.5.0.8.0 · 14.6.0.4.0 · 14.7.0.2.0 · 14.7.1.0.0 |
| Oracle Financial Services Applications | Infrastructure (jsoup) | 14.0-14.3, 14.5-14.7 | 14.5 · 14.6 · 14.7 |
| Oracle Financial Services Applications | Installer (jsoup) | 8.1.2.3,8.1.2.4 | 8.1.2.3 · 8.1.2.4 |
| Oracle Financial Services Applications | Internal Operations (jsoup) | 14.5.0-14.7.0 | |
| Oracle Financial Services Applications | Onboarding Batch Processes (jsoup) | 14.5-14.7 | |
| Oracle Financial Services Applications | Reports (jsoup) | 14.5.0-14.7.0 | |
| Oracle Financial Services Applications | Security (jsoup) | 14.7.0.2.0, 14.7.1.0.0 | 14.7.0.2.0 · 14.7.1.0.0 |
| Oracle Financial Services Applications | Studio (jsoup) | 8.0.8.3.1 | 8.0.8.3.1 |
| Oracle Financial Services Applications | UI General (jsoup) | 18.2, 18.3, 19.1, 19.2, 21.1, 22.1, 22.2 | 18.2 · 18.3 · 19.1 · 19.2 · 21.1 · 22.1 · 22.2 |
| Oracle Fusion Middleware | General (jsoup) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Installer (jsoup) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (jsoup) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (jsoup) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle GoldenGate | Oracle GoldenGate Stream Analytics (jsoup) | 19.1.0.0.0-19.1.0.0.7 | |
| Oracle PeopleSoft | Elastic Search (jsoup) | 8.58, 8.59, 8.60 | 8.58 · 8.59 · 8.60 |
| Oracle Retail Applications | Internal Operations (jsoup) | 18.0.0.12, 19.0.0.6 | 18.0.0.12 · 19.0.0.6 |
| Oracle Systems | Tools (jsoup) | 4 | 4 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.jsoup:jsoup |
0 | 1.15.3 |
unbounded |
Products and versions
5 products, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | jsoup | jsoup | generic | ＜ 1.15.3 |
| nvd | netapp | management services for element software | generic | any version |
| nvd | netapp | management services for netapp hci | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| osv | org.jsoup | jsoup | generic | ＜ 1.15.3 |
References
Timeline
Timeline
| Published | 2022-08-29 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |