Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-9802US | medium6.1 | — | ||
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by pas… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.htmlWEB
- http://www.securityfocus.com/archive/1/541024/100/0/threadedWEB
- http://www.securityfocus.com/bid/100284WEB
- https://issues.apache.org/jira/browse/SLING-7041WEB
- https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91@%3Cdev.sling.apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-9802ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan