CVE-2016-5394: XSS
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5394?
CVE-2016-5394 is classified as a high severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2016-5394?
To fix CVE-2016-5394, upgrade to Apache Sling XSS Protection API module version 1.0.12 or higher.
What causes the vulnerability in CVE-2016-5394?
The vulnerability in CVE-2016-5394 is caused by insufficient encoding in the XSSAPI.encodeForJSString() method, allowing script tags to pass through.
What applications are affected by CVE-2016-5394?
CVE-2016-5394 affects versions of the Apache Sling XSS Protection API module prior to 1.0.12.
Is there a workaround for CVE-2016-5394?
There are no effective workarounds for CVE-2016-5394; upgrading to a patched version is the recommended solution.