Description
Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.sling:org.apache.sling.api | < 2.2.2 | 2.2.2 | GHSA-rxvx-44w5-44r7 |
| Maven | org.apache.sling:org.apache.sling.servlets.post | < 2.1.2 | 2.1.2 | GHSA-rxvx-44w5-44r7 |
References
- JVN#61328139 third-party-advisory
- 74839 vdb-entry
- https://issues.apache.org/jira/browse/SLING-2082
- JVNDB-2015-000069 third-party-advisory
- [sling-dev] 20210409 [jira] [Created] (SLING-10284) Dependency check fails on CVE-2015-2944 for Sling Resource Merger 1.4.0 mailing-list
- [sling-dev] 20210409 [jira] [Commented] (SLING-10284) Dependency check fails on CVE-2015-2944 for Sling Resource Merger 1.4.0 mailing-list
- [sling-dev] 20210409 [jira] [Comment Edited] (SLING-10284) Dependency check fails on CVE-2015-2944 for Sling Resource Merger 1.4.0 mailing-list
- [sling-dev] 20210409 [jira] [Resolved] (SLING-10284) Dependency check fails on CVE-2015-2944 for Sling Resource Merger 1.4.0 mailing-list