Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS14d2Y0LTg4eHItaHgyas4AAQZ1

Cross site scripting in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Permalink: https://github.com/advisories/GHSA-xwf4-88xr-hx2j
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14d2Y0LTg4eHItaHgyas4AAQZ1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 7 months ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-xwf4-88xr-hx2j, CVE-2016-5394
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-5394
• https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525@%3Cdev.sling.apache.org%3E
• http://www.securityfocus.com/bid/99870
• https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-5394
• https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529
• https://github.com/advisories/GHSA-xwf4-88xr-hx2j

Repository: https://github.com/jensdietrich/xshady-release
Blast Radius: 8.8

Affected Packages