CVE-2015-2944: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2944?
CVE-2015-2944 is considered a medium severity cross-site scripting vulnerability.
How do I fix CVE-2015-2944?
To fix CVE-2015-2944, upgrade Apache Sling API to version 2.2.2 or later, and Apache Sling Servlets Post to version 2.1.2 or later.
What systems are affected by CVE-2015-2944?
CVE-2015-2944 affects Apache Sling API versions before 2.2.2 and Apache Sling Servlets Post versions before 2.1.2.
What kind of attacks can be executed through CVE-2015-2944?
CVE-2015-2944 allows remote attackers to inject arbitrary web scripts or HTML, leading to potential user data theft or session hijacking.
Is CVE-2015-2944 still a threat if I'm running the latest version?
No, if you are using the patched versions of Apache Sling API and Servlets Post, CVE-2015-2944 should not pose a threat.