GitHub Advisoryadvisory · Maven

GHSA-7mfw-43c4-45mq Cross-site Scripting in Apache Sling XSS Protection API

MEDIUM Published 2022-05-14 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-15717
Ecosystem
Maven
Packages
org.apache.sling:org.apache.sling.xss, org.apache.sling:org.apache.sling.xss.compat
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-01

Affected packages

• Maven org.apache.sling:org.apache.sling.xss: >= 1.0.4, < 2.0.4 → fixed in 2.0.4 • Maven org.apache.sling:org.apache.sling.xss.compat: 1.1.0 (no fix yet)

Description

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

Related

Alias · CVE (1)

  • CVE-2017-15717 A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References