Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1yeHZ4LTQ0dzUtNDRyN83x6A
Improper Neutralization of Input During Web Page Generation in Apache Sling
Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Permalink: https://github.com/advisories/GHSA-rxvx-44w5-44r7JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yeHZ4LTQ0dzUtNDRyN83x6A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago
Identifiers: GHSA-rxvx-44w5-44r7, CVE-2015-2944
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-2944
- https://issues.apache.org/jira/browse/SLING-2082
- https://lists.apache.org/thread.html/r04237d561f3e5bced0a26287454450a34275162aa6b1dbae1b707b31@%3Cdev.sling.apache.org%3E
- https://lists.apache.org/thread.html/r4f41dd891a52133abdbf7f74ad1dde80c46f157c1f1cf8c23ba60a70@%3Cdev.sling.apache.org%3E
- https://lists.apache.org/thread.html/r93d68359eb0ea8c0f26d71ca3998143f99209a24db7b4dacfc688cea@%3Cdev.sling.apache.org%3E
- https://lists.apache.org/thread.html/rd2a352858630721e7b1655bbdf85e692d6156fcfe68109e12b017b16@%3Cdev.sling.apache.org%3E
- http://jvn.jp/en/jp/JVN61328139/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000069
- https://github.com/advisories/GHSA-rxvx-44w5-44r7
Affected Packages
maven:org.apache.sling:org.apache.sling.servlets.post
Dependent packages: 84Dependent repositories: 676
Downloads:
Affected Version Ranges: <= 2.1.1
Fixed in: 2.1.2
All affected versions: 2.1.0
All unaffected versions: 2.1.2, 2.2.0, 2.3.0, 2.3.2, 2.3.4, 2.3.6, 2.3.8, 2.3.10, 2.3.12, 2.3.14, 2.3.16, 2.3.18, 2.3.20, 2.3.22, 2.3.24, 2.3.26, 2.3.28, 2.3.30, 2.3.32, 2.3.34, 2.3.36, 2.4.2, 2.4.4, 2.4.6, 2.5.0, 2.6.0
maven:org.apache.sling:org.apache.sling.api
Dependent packages: 589Dependent repositories: 772
Downloads:
Affected Version Ranges: <= 2.2.1
Fixed in: 2.2.2
All affected versions: 2.0.6, 2.0.8, 2.1.0, 2.2.0
All unaffected versions: 2.2.2, 2.2.4, 2.3.0, 2.4.0, 2.4.2, 2.5.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0, 2.11.0, 2.12.0, 2.14.0, 2.14.2, 2.15.0, 2.16.0, 2.16.2, 2.16.4, 2.18.0, 2.18.2, 2.18.4, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.23.4, 2.23.6, 2.24.0, 2.25.0, 2.25.4, 2.26.0, 2.27.0, 2.27.2