CVE-2017-15717 Security Details

CVE ID

CVE-2017-15717

CWE

CWE-79

CVE Description

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

Published

Jan 12, 2018

CVSS Score & Severity

6.1Medium

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

1.590%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/sling/xss/impl/XSSAPIImpl.getValidHref(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

Apache Jira · SLING-7323THIRD_PARTY