Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post

2022-05-1402:45:32

Google

osv.dev

0.002 Low

EPSS

Percentile

62.1%

JSON

The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript ‘eval’ function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.

CPENameOperatorVersion
org.apache.sling:org.apache.sling.servlets.posteq2.3.2
org.apache.sling:org.apache.sling.servlets.posteq2.0.2-incubator
org.apache.sling:org.apache.sling.servlets.posteq2.3.10
org.apache.sling:org.apache.sling.servlets.posteq2.1.0
org.apache.sling:org.apache.sling.servlets.posteq2.3.16
org.apache.sling:org.apache.sling.servlets.posteq2.2.0
org.apache.sling:org.apache.sling.servlets.posteq2.3.20
org.apache.sling:org.apache.sling.servlets.posteq2.3.4
org.apache.sling:org.apache.sling.servlets.posteq2.3.8
org.apache.sling:org.apache.sling.servlets.posteq2.3.18

Name	Operator	Version
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.2
org.apache.sling:org.apache.sling.servlets.post	eq	2.0.2-incubator
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.10
org.apache.sling:org.apache.sling.servlets.post	eq	2.1.0
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.16
org.apache.sling:org.apache.sling.servlets.post	eq	2.2.0
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.20
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.4
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.8
org.apache.sling:org.apache.sling.servlets.post	eq	2.3.18