GHSA-7mfw-43c4-45mq

Source

https://github.com/advisories/GHSA-7mfw-43c4-45mq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7mfw-43c4-45mq/GHSA-7mfw-43c4-45mq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7mfw-43c4-45mq

Aliases

CVE-2017-15717

Published

2022-05-14T03:46:36Z

Modified

2023-11-08T03:58:58.608500Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in Apache Sling XSS Protection API

Details

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2022-07-01T18:51:36Z",
    "nvd_published_at": "2018-01-10T14:29:00Z"
}

References

Affected packages

Maven / org.apache.sling:org.apache.sling.xss

Package

Name: org.apache.sling:org.apache.sling.xss; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.xss

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.4

Fixed

2.0.4

Affected versions

1.*

1.0.4

1.0.6

1.0.8

1.0.12

1.0.14

1.0.16

1.0.18

2.*

2.0.0

Maven / org.apache.sling:org.apache.sling.xss.compat

Package

Name: org.apache.sling:org.apache.sling.xss.compat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.sling/org.apache.sling.xss.compat

Affected ranges

Affected versions

1.*

1.1.0