Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-9802US | medium6.1 | — | ||
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by pas… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.htmlWEB
- http://www.securityfocus.com/archive/1/541024/100/0/threadedWEB
- http://www.securityfocus.com/bid/100284WEB
- https://issues.apache.org/jira/browse/SLING-7041WEB
- https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91@%3Cdev.sling.apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-9802ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan