Search
Find a vulnerability
Search criteria
12 vulnerabilities found for sling_xss_protection_api by apache
CVE-2026-92001 (GCVE-0-2026-92001)
Vulnerability from nvd – Published: 2026-09-23 09:20 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Missing parser resource limits
Summary
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:14 UTC
CWE
- CWE-776 - Improper restriction of recursive entity references in DTDs ('XML entity expansion')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/m52jll26vc8g5jokb… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-92001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:14:39.290915Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:14:44.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:15.717Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-776",
"description": "CWE-776 Improper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:20:52.311Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr"
}
],
"source": {
"defect": [
"SLING-13336"
],
"discovery": "UNKNOWN"
},
"title": "Apache Sling XSS: Missing parser resource limits",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-92001",
"datePublished": "2026-09-23T09:20:52.311Z",
"dateReserved": "2026-09-15T11:15:33.640Z",
"dateUpdated": "2026-09-23T17:08:15.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91999 (GCVE-0-2026-91999)
Vulnerability from nvd – Published: 2026-09-23 09:23 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/xpcsdkr80ow9p13f7… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:05:07.662459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:05:23.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:14.732Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:23:22.037Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4"
}
],
"source": {
"defect": [
"SLING-13335"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: Improper escaping in the XSS Webconsole plugin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91999",
"datePublished": "2026-09-23T09:23:22.037Z",
"dateReserved": "2026-09-15T11:11:29.968Z",
"dateUpdated": "2026-09-23T17:08:14.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91928 (GCVE-0-2026-91928)
Vulnerability from nvd – Published: 2026-09-23 09:37 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:02 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/yfb1q6zob8mth5lr4… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:02:16.525807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:02:47.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:13.709Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:37:49.295Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02"
}
],
"source": {
"defect": [
"SLING-13333"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91928",
"datePublished": "2026-09-23T09:37:49.295Z",
"dateReserved": "2026-09-15T10:58:12.211Z",
"dateUpdated": "2026-09-23T17:08:13.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91852 (GCVE-0-2026-91852)
Vulnerability from nvd – Published: 2026-09-23 09:29 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:04 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sling.apache.org/news.html | vendor-advisory |
| https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:04:21.554097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:04:40.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:12.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apache Sling would like to thank the github user n0mi1k, the group of Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat, Ali Javidi Ghasr and Mohammad A. Tayebi and The Apache Software Foundation for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:29:11.099Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://sling.apache.org/news.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo"
}
],
"source": {
"defect": [
"https://issues.apache.org/jira/browse/SLING-13334"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91852",
"datePublished": "2026-09-23T09:29:11.099Z",
"dateReserved": "2026-09-15T08:57:35.201Z",
"dateUpdated": "2026-09-23T17:08:12.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73192 (GCVE-0-2026-73192)
Vulnerability from nvd – Published: 2026-09-23 09:09 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
Summary
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.
Upgrade to Apache Sling XSS >= 2.4.12
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sling.apache.org/news.html | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:05:46.959656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:06:14.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:11.709Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apache Sling would like to thank github user Vectrain51 and n0mi1k for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\u003cbr\u003e\u003cbr\u003e\u003cspan\u003eUpgrade to Apache Sling XSS \u0026gt;= 2.4.12\u003c/span\u003e"
}
],
"value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\n\nUpgrade to Apache Sling XSS \u003e= 2.4.12"
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:09:43.637Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://sling.apache.org/news.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: XSS possible through XSSAPI.getValidHref()",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-73192",
"datePublished": "2026-09-23T09:09:43.637Z",
"dateReserved": "2026-08-11T11:21:29.423Z",
"dateUpdated": "2026-09-23T17:08:11.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-15717 (GCVE-0-2017-15717)
Vulnerability from nvd – Published: 2018-01-10 14:00 – Updated: 2024-09-17 01:06
VLAI
EPSS
VEX
Summary
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Severity
No CVSS data available.
CWE
- Insufficient XSS protection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://s.apache.org/CVE-2017-15717 | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling |
Affected:
XSS Protection API 1.0.4 to 1.0.18
Affected: XSS Protection API Compat 1.1.0 Affected: XSS Protection API 2.0.0 |
Date Public
2018-01-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:04:49.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://s.apache.org/CVE-2017-15717"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Sling",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "XSS Protection API 1.0.4 to 1.0.18"
},
{
"status": "affected",
"version": "XSS Protection API Compat 1.1.0"
},
{
"status": "affected",
"version": "XSS Protection API 2.0.0"
}
]
}
],
"datePublic": "2018-01-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Insufficient XSS protection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-10T13:57:01.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://s.apache.org/CVE-2017-15717"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2018-01-10T00:00:00",
"ID": "CVE-2017-15717",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Sling",
"version": {
"version_data": [
{
"version_value": "XSS Protection API 1.0.4 to 1.0.18"
},
{
"version_value": "XSS Protection API Compat 1.1.0"
},
{
"version_value": "XSS Protection API 2.0.0"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficient XSS protection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"refsource": "MLIST",
"url": "https://s.apache.org/CVE-2017-15717"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2017-15717",
"datePublished": "2018-01-10T14:00:00.000Z",
"dateReserved": "2017-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:06:14.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-91928 (GCVE-0-2026-91928)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:37 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:02 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/yfb1q6zob8mth5lr4… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:02:16.525807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:02:47.461Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:13.709Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:37:49.295Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02"
}
],
"source": {
"defect": [
"SLING-13333"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91928",
"datePublished": "2026-09-23T09:37:49.295Z",
"dateReserved": "2026-09-15T10:58:12.211Z",
"dateUpdated": "2026-09-23T17:08:13.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91852 (GCVE-0-2026-91852)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:29 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:04 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sling.apache.org/news.html | vendor-advisory |
| https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:04:21.554097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:04:40.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:12.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apache Sling would like to thank the github user n0mi1k, the group of Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat, Ali Javidi Ghasr and Mohammad A. Tayebi and The Apache Software Foundation for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:29:11.099Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://sling.apache.org/news.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo"
}
],
"source": {
"defect": [
"https://issues.apache.org/jira/browse/SLING-13334"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91852",
"datePublished": "2026-09-23T09:29:11.099Z",
"dateReserved": "2026-09-15T08:57:35.201Z",
"dateUpdated": "2026-09-23T17:08:12.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91999 (GCVE-0-2026-91999)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:23 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:05 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/xpcsdkr80ow9p13f7… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:05:07.662459Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:05:23.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:14.732Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:23:22.037Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4"
}
],
"source": {
"defect": [
"SLING-13335"
],
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: Improper escaping in the XSS Webconsole plugin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91999",
"datePublished": "2026-09-23T09:23:22.037Z",
"dateReserved": "2026-09-15T11:11:29.968Z",
"dateUpdated": "2026-09-23T17:08:14.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92001 (GCVE-0-2026-92001)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:20 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: Missing parser resource limits
Summary
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
This issue affects Apache Sling XSS: before 2.4.12.
Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:14 UTC
CWE
- CWE-776 - Improper restriction of recursive entity references in DTDs ('XML entity expansion')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/m52jll26vc8g5jokb… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-92001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:14:39.290915Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:14:44.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:15.717Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Code"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027) vulnerability in Apache Sling XSS.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling XSS: before 2.4.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 2.4.12, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027) vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-776",
"description": "CWE-776 Improper restriction of recursive entity references in DTDs (\u0027XML entity expansion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:20:52.311Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr"
}
],
"source": {
"defect": [
"SLING-13336"
],
"discovery": "UNKNOWN"
},
"title": "Apache Sling XSS: Missing parser resource limits",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-92001",
"datePublished": "2026-09-23T09:20:52.311Z",
"dateReserved": "2026-09-15T11:15:33.640Z",
"dateUpdated": "2026-09-23T17:08:15.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73192 (GCVE-0-2026-73192)
Vulnerability from cvelistv5 – Published: 2026-09-23 09:09 – Updated: 2026-09-23 17:08
VLAI
EPSS
VEX
Title
Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
Summary
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.
Upgrade to Apache Sling XSS >= 2.4.12
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 14:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://sling.apache.org/news.html | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling XSS |
Affected:
0 , < 2.4.12
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T14:05:46.959656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:06:14.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T17:08:11.709Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Sling XSS",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "2.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apache Sling would like to thank github user Vectrain51 and n0mi1k for reporting this issue"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\u003cbr\u003e\u003cbr\u003e\u003cspan\u003eUpgrade to Apache Sling XSS \u0026gt;= 2.4.12\u003c/span\u003e"
}
],
"value": "An improper neutralization of input during web page generation (\u0027Cross-site Scripting\u0027) [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\n\nUpgrade to Apache Sling XSS \u003e= 2.4.12"
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T09:09:43.637Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://sling.apache.org/news.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Sling XSS: XSS possible through XSSAPI.getValidHref()",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-73192",
"datePublished": "2026-09-23T09:09:43.637Z",
"dateReserved": "2026-08-11T11:21:29.423Z",
"dateUpdated": "2026-09-23T17:08:11.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-15717 (GCVE-0-2017-15717)
Vulnerability from cvelistv5 – Published: 2018-01-10 14:00 – Updated: 2024-09-17 01:06
VLAI
EPSS
VEX
Summary
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Severity
No CVSS data available.
CWE
- Insufficient XSS protection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://s.apache.org/CVE-2017-15717 | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Sling |
Affected:
XSS Protection API 1.0.4 to 1.0.18
Affected: XSS Protection API Compat 1.1.0 Affected: XSS Protection API 2.0.0 |
Date Public
2018-01-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:04:49.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://s.apache.org/CVE-2017-15717"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Apache Sling",
"vendor": "Apache Software Foundation",
"versions": [
{
"status": "affected",
"version": "XSS Protection API 1.0.4 to 1.0.18"
},
{
"status": "affected",
"version": "XSS Protection API Compat 1.1.0"
},
{
"status": "affected",
"version": "XSS Protection API 2.0.0"
}
]
}
],
"datePublic": "2018-01-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Insufficient XSS protection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-10T13:57:01.000Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://s.apache.org/CVE-2017-15717"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2018-01-10T00:00:00",
"ID": "CVE-2017-15717",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Sling",
"version": {
"version_data": [
{
"version_value": "XSS Protection API 1.0.4 to 1.0.18"
},
{
"version_value": "XSS Protection API Compat 1.1.0"
},
{
"version_value": "XSS Protection API 2.0.0"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficient XSS protection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[users] 20180110 CVE-2017-15717: Insufficient XSS protection for HREF attributes in Apache Sling XSS Protection API",
"refsource": "MLIST",
"url": "https://s.apache.org/CVE-2017-15717"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2017-15717",
"datePublished": "2018-01-10T14:00:00.000Z",
"dateReserved": "2017-10-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:06:14.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}