CVE-2016-5394: XSS
First published: Wed Jul 19 2017(Updated: )
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.sling:org.apache.sling.xss.compat | <1.1.0 | 1.1.0 |
| maven/org.apache.sling:org.apache.sling.xss | <1.0.12 | 1.0.12 |
| Apache Sling API | <1.0.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2016-5394
- https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525@%3Cdev.sling.apache.org%3E
- http://www.securityfocus.com/bid/99870
- https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-5394
- https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529
- https://github.com/advisories/GHSA-xwf4-88xr-hx2j (Advisory)
- https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2016-5394?
CVE-2016-5394 is classified as a high severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2016-5394?
To fix CVE-2016-5394, upgrade to Apache Sling XSS Protection API module version 1.0.12 or higher.
What causes the vulnerability in CVE-2016-5394?
The vulnerability in CVE-2016-5394 is caused by insufficient encoding in the XSSAPI.encodeForJSString() method, allowing script tags to pass through.
What applications are affected by CVE-2016-5394?
CVE-2016-5394 affects versions of the Apache Sling XSS Protection API module prior to 1.0.12.
Is there a workaround for CVE-2016-5394?
There are no effective workarounds for CVE-2016-5394; upgrading to a patched version is the recommended solution.
- collector/github-advisory-latest
- alias/GHSA-xwf4-88xr-hx2j
- alias/CVE-2016-5394
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- vendor/apache
- canonical/apache sling api