Cross-Site Scripting Vulnerability in Apache Sling XSS Protection API
CVE-2016-5394

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Sling
Vendor
CVE Published:
19 July 2017

Summary

The XSS Protection API module in Apache Sling, prior to version 1.0.12, suffers from a vulnerability due to insufficient input encoding in the XSSAPI.encodeForJSString() method. This weakness permits certain input patterns to bypass encoding, allowing the injection of script tags and exposing applications to potential Cross-Site Scripting (XSS) attacks. This vulnerability can lead to unauthorized execution of scripts in the context of the user's browser, hence compromising the security of the web application.

Affected Version(s)

Apache Sling prior to 1.0.12

References

https://lists.apache.org/thread.html/332166037a54b97cf41e...
x_refsource_MISC
http://www.securityfocus.com/bid/99870
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.