Skip to content
fr Sign in
Not rated

CVE-2017-15717 A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and…

Description

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

Affected products and versions

Product Affected versions Fixed in
Apache Sling Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Sling

The 7 CVEs of Apache Sling →
CVE-2023-25621 Privilege Escalation vulnerability in Apache Software Foundation Apache Sling Not rated CVE-2022-32549 Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection Not rated CVE-2012-3353 The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to… Not rated CVE-2017-15700 A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0… Not rated
Track this CVE