GitHub Advisoryadvisory · Maven

GHSA-rxvx-44w5-44r7 Improper Neutralization of Input During Web Page Generation in Apache Sling

MEDIUM Published 2022-05-13 Modified 2022-07-06 Official page ↗
Aliases
CVE-2015-2944
Ecosystem
Maven
Packages
org.apache.sling:org.apache.sling.api, org.apache.sling:org.apache.sling.servlets.post
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-07-06

Affected packages

• Maven org.apache.sling:org.apache.sling.api: < 2.2.2 → fixed in 2.2.2 • Maven org.apache.sling:org.apache.sling.servlets.post: < 2.1.2 → fixed in 2.1.2

Description

Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.

Related

Alias · CVE (1)

  • CVE-2015-2944 Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References