Low WID-SEC-2023-0954 1 CVE

Apache Sling: Schwachstelle ermöglicht Cross-Site Scripting

Published Apr 12, 2023 · Updated Apr 12, 2023 · de-DE

Vendor: Apache Product: Sling Engine < 2.14.0

Summary

Ein entfernter Angreifer kann eine Schwachstelle in Apache Sling ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Apache Sling ist ein Open Source-Webframework für die Java-Plattform.

Vulnerabilities 1

High 8.0

CVE-2022-45064

Apache Sling Engine: Include-based XSS

The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a reso…

Apache Software Foundation Apache Sling Engine org.apache.sling:org.apache.sling.engine Maven

Apr 13, 2023

Revision history

2023-04-12 #1
Initiale Fassung

References

Seclists.org Security Notification vom 2023-04-12
https://seclists.org/oss-sec/2023/q2/16