CVE-2017-9802: Apache Sling XSS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Sling Servlets Post 2.3.20 Description: The Javascript method Sling.evalString() uses the javascript `eval` function to parse input strings, which allows for XSS attacks by passing specially crafted input strings. Mitigation: Users should upgrade to version 2.3.22 or later of the Sling Servlets Post bundle. Credit: This issue was discovered and reported by Dmitriev V. Daniil Dmitriev V. Daniil <sgoesw@xxxxxxxxx>. References: - https://issues.apache.org/jira/browse/SLING-7041 - https://sling.apache.org/project-information/security.html Robert Munteanu
Attachment:
signature.asc
Description: This is a digitally signed message part
