XML External Entity Reference in Apache Sling

Also known as GHSA-7g54-vgp6-jj5w

Published 9 y ago 2017-07-19 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.7%

percentile 90%

Public exploits

none known

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.

Exploit prediction (EPSS)

3.67% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.sling:org.apache.sling.xss`	<1.0.12	1.0.12
maven	`org.apache.sling:org.apache.sling.xss.compat`	<1.1.0	1.1.0

Affected products

Apache Software Foundation Apache Sling

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

lists.apache.org /thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apach · x_refsource_MISC, x_transferred
securityfocus.com /bid/99873 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-6798 · advisory
github.com /apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529 · web
github.com /jensdietrich/xshady-release/tree/main/CVE-2016-6798 · web
lists.apache.org /thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0@%3Cdev.sling.apache. · web

Sources

CVE List: CVE-2016-6798
GitHub Advisory: GHSA-7g54-vgp6-jj5w
NVD: CVE-2016-6798

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary