Cross site scripting in Apache Sling

Also known as GHSA-xwf4-88xr-hx2j

Published 9 y ago 2017-07-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.1 · NVD

CISA KEV

not known exploited

EPSS

2.6%

percentile 85%

Public exploits

none known

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Exploit prediction (EPSS)

2.60% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.1	6.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.sling:org.apache.sling.xss`	<1.0.12	1.0.12
maven	`org.apache.sling:org.apache.sling.xss.compat`	<1.1.0	1.1.0

Affected products

Apache Software Foundation Apache Sling

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

lists.apache.org /thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apach · x_refsource_MISC, x_transferred
securityfocus.com /bid/99870 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-5394 · advisory
github.com /apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529 · web
github.com /jensdietrich/xshady-release/tree/main/CVE-2016-5394 · web
lists.apache.org /thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525@%3Cdev.sling.apache. · web

Sources

CVE List: CVE-2016-5394
GitHub Advisory: GHSA-xwf4-88xr-hx2j
NVD: CVE-2016-5394

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary