PT-2017-19195 · Apache · Apache Sling Servlets Post

Published 2017-08-14 · Updated 2022-05-14 · CVE-2017-9802

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Sling Servlets Post versions prior to 2.3.22

Description The issue concerns the Javascript method Sling.evalString() which uses the javascript eval function to parse input strings. This allows for XSS attacks by passing specially crafted input strings.

Recommendations For versions prior to 2.3.22, update to version 2.3.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Sling.evalString() method to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-9802

GHSA-8C82-9RGP-4QVR

Affected Products

Apache Sling Servlets Post

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2017-9802 · Security Note
• https://issues.apache.org/jira/browse/SLING-7041 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c82-9rgp-4qvr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9802 · Vendor Advisory
• https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91@%3Cdev.sling.apache.org%3E · Note
• http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html · Note
• https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E · Note
• http://securityfocus.com/archive/1/541024/100/0/threaded · Note
• http://securityfocus.com/bid/100284 · Note