CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Score

CVSS 3.1 6.1 Medium

Status

Modified - secalert@redhat.com

Published

2017-07-19

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Sling (Apache)
• Apache Sling (Apache Software Foundation)

References

• http://www.securityfocus.com/bid/99870
• https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org…