XSS in Apache Sling Api
CVE-2015-2944
Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.
Affected products
- Apache Sling_api
- Apache Sling_servlets_post
- N/a — versions n/a
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (x_refsource_JVN, Vendor Advisory, third-party-advisory)
- vultures@jpcert.or.jp (vdb-entry, x_refsource_BID)
- vultures@jpcert.or.jp (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- vultures@jpcert.or.jp (x_refsource_JVNDB, Vendor Advisory, third-party-advisory)
- vultures@jpcert.or.jp (mailing-list, x_refsource_MLIST)
- vultures@jpcert.or.jp (mailing-list, x_refsource_MLIST)
- vultures@jpcert.or.jp (mailing-list, x_refsource_MLIST)
- vultures@jpcert.or.jp (mailing-list, x_refsource_MLIST)