CVE-2015-2944

Currently unrated

Key Information:

Vendor
Apache
Status
Sling Servlets Post
Sling Api
Vendor
CVE Published:
2 June 2015

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.

References

http://jvn.jp/en/jp/JVN61328139/index.html
third-party-advisoryx_refsource_JVN
http://www.securityfocus.com/bid/74839
vdb-entryx_refsource_BID
https://issues.apache.org/jira/browse/SLING-2082
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.