CVE-2016-5394

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Sling
Vendor
CVE Published:
19 July 2017

Summary

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Affected Version(s)

Apache Sling prior to 1.0.12

References

https://lists.apache.org/thread.html/332166037a54b97cf41e...
x_refsource_MISC
http://www.securityfocus.com/bid/99870
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.