PT-2017-19195 · Apache · Apache Sling Servlets Post

Publicado 2017-08-14 · Atualizado 2022-05-14 · CVE-2017-9802

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling Servlets Post versions prior to 2.3.22

Description The issue concerns the Javascript method Sling.evalString() which uses the javascript eval function to parse input strings. This allows for XSS attacks by passing specially crafted input strings.

Recommendations For versions prior to 2.3.22, update to version 2.3.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Sling.evalString() method to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-9802

GHSA-8C82-9RGP-4QVR

Produtos afetados

Apache Sling Servlets Post

Referências · 9

• https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91@%3Cdev.sling.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-9802 · Nota de Segurança
• https://issues.apache.org/jira/browse/SLING-7041 · Aviso do Fabricante
• http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html · Nota
• https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-8c82-9rgp-4qvr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-9802 · Aviso do Fabricante
• http://securityfocus.com/archive/1/541024/100/0/threaded · Nota
• http://securityfocus.com/bid/100284 · Nota