PT-2015-5993 · Apache · Apache Sling Servlets Post+1

Henry Kuijpers · Published 2015-06-02 · Updated 2022-05-13 · CVE-2015-2944

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling API versions prior to 2.2.2 Apache Sling Servlets Post versions prior to 2.1.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via the URI. This is related to the org/apache/sling/api/servlets/HtmlResponse and org/apache/sling/servlets/post/HtmlResponse components.

Recommendations For Apache Sling API versions prior to 2.2.2, update to version 2.2.2 or later. For Apache Sling Servlets Post versions prior to 2.1.2, update to version 2.1.2 or later. As a temporary workaround, consider restricting access to the org/apache/sling/api/servlets/HtmlResponse and org/apache/sling/servlets/post/HtmlResponse components until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2944

GHSA-RXVX-44W5-44R7

Affected Products

Apache Sling

Apache Sling Servlets Post

References · 16

• 🔥 https://issues.apache.org/jira/browse/SLING-2082 · Exploit
• http://jvndb.jvn.jp/jvndb/JVNDB-2015-000069 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2944 · Security Note
• http://jvn.jp/en/jp/JVN61328139/index.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxvx-44w5-44r7 · Vendor Advisory
• http://securityfocus.com/bid/74839 · Note
• https://lists.apache.org/thread.html/r4f41dd891a52133abdbf7f74ad1dde80c46f157c1f1cf8c23ba60a70@%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/r93d68359eb0ea8c0f26d71ca3998143f99209a24db7b4dacfc688cea@%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/r04237d561f3e5bced0a26287454450a34275162aa6b1dbae1b707b31%40%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/r04237d561f3e5bced0a26287454450a34275162aa6b1dbae1b707b31@%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/r93d68359eb0ea8c0f26d71ca3998143f99209a24db7b4dacfc688cea%40%3Cdev.sling.apache.org%3E · Note
• https://t.me/cvenotify/12989 · Telegram Post
• https://lists.apache.org/thread.html/rd2a352858630721e7b1655bbdf85e692d6156fcfe68109e12b017b16%40%3Cdev.sling.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4f41dd891a52133abdbf7f74ad1dde80c46f157c1f1cf8c23ba60a70%40%3Cdev.sling.apache.org%3E · Note
• https://t.me/cvenotify/13017 · Telegram Post