Apache Sling Servlets Post 2.3.20 Cross Site Scripting

Apache Sling Sevlets Post version 2.3.20 suffers from a cross site scripting vulnerability.

MD5 | b3d8d7e5b63832c23098e1169962280f

CVE-2017-9802: Apache Sling XSS vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Sling Servlets Post 2.3.20

The Javascript method Sling.evalString() uses the javascript `eval`
function to parse input strings, which allows for XSS attacks by
passing specially crafted input strings.

Users should upgrade to version 2.3.22 or later of the Sling Servlets
Post bundle.

Credit: This issue was discovered and reported by Dmitriev V.
Daniil Dmitriev V. Daniil <[email protected]>.


- https://issues.apache.org/jira/browse/SLING-7041
- https://sling.apache.org/project-information/security.html

Robert Munteanu

Related Posts