Apache Sling Xss
Monthly
Cross-site scripting in the Apache Sling XSS Protection API before version 2.4.12 allows unauthenticated remote attackers to have attacker-supplied script execute in a victim's browser session when an application built on the library routes untrusted, attacker-influenced input through the flawed sanitization/encoding routines and reflects it into an HTML response. Because the affected artifact is a shared library rather than a standalone server, exposure depends entirely on the consuming application - most commonly Apache Sling-based sites and Adobe Experience Manager - and exploitation requires the victim to load the crafted page or click a malicious link (user interaction). Neither NVD nor Apache published a CVSS score for this issue, so severity must be inferred from the library-level flaw and the deployed context; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (unauthenticated, user-interaction dependent, scoped impact affecting the embedding application), and no public exploit identified at time of analysis.
Cross-site scripting in Apache Sling XSS before 2.4.12 allows remote attackers to inject script that executes in a victim's browser when an application relying on the library's output encoding and sanitization renders attacker-influenced input through a code path where neutralization is incomplete. Exploitation is conditional: it requires a reflected or stored injection point in the consuming application and victim interaction (loading the affected page) for script execution, and applications that apply their own independent output encoding are not exposed. The vendor-released fix is version 2.4.12; no public exploit code identified at time of analysis, no EPSS data was supplied, and no public CVSS score or vector (Apache and NVD both N/A) exists, so severity must be inferred from the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Cross-site scripting in Apache Sling XSS versions before 2.4.12 allows unauthenticated remote attackers to defeat the library's input-neutralization logic, so that crafted input passed through the affected encoding/filtering API is rendered unsafely in a victim's browser (user interaction required per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The impact is indirect but broad: this library is the component downstream applications call to sanitize untrusted input, so a bypass silently re-exposes every consuming application to reflected or stored XSS. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the vendor has released a fix in version 2.4.12.
Denial of service in Apache Sling XSS (before 2.4.12) allows remote unauthenticated attackers to exhaust server resources by passing XML content with recursively defined DTD entities through the Sling XSS protection module, which expands them without bound. This CWE-776 XML entity expansion flaw only affects availability (no data compromise) and requires the application to route attacker-controlled XML to the vulnerable parser. No public exploit code or active exploitation has been identified, and the vendor recommends upgrading to 2.4.12.
Reflected cross-site scripting in the Apache Sling XSS library 2.4.10 and earlier arises because the XSSAPI.getValidHref() helper fails to properly neutralize certain attacker-supplied values, returning an href that a consuming application may then render into a page. Remote, unauthenticated attackers can exploit this only where a downstream application actually uses getValidHref() as its sanitizer for attacker-influenced link values and reflects that value back to users, and a victim must click a crafted link for the script to execute (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and overall risk is low because reachability depends entirely on how an embedding application wires up this method.
Cross-site scripting in the Apache Sling XSS Protection API before version 2.4.12 allows unauthenticated remote attackers to have attacker-supplied script execute in a victim's browser session when an application built on the library routes untrusted, attacker-influenced input through the flawed sanitization/encoding routines and reflects it into an HTML response. Because the affected artifact is a shared library rather than a standalone server, exposure depends entirely on the consuming application - most commonly Apache Sling-based sites and Adobe Experience Manager - and exploitation requires the victim to load the crafted page or click a malicious link (user interaction). Neither NVD nor Apache published a CVSS score for this issue, so severity must be inferred from the library-level flaw and the deployed context; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (unauthenticated, user-interaction dependent, scoped impact affecting the embedding application), and no public exploit identified at time of analysis.
Cross-site scripting in Apache Sling XSS before 2.4.12 allows remote attackers to inject script that executes in a victim's browser when an application relying on the library's output encoding and sanitization renders attacker-influenced input through a code path where neutralization is incomplete. Exploitation is conditional: it requires a reflected or stored injection point in the consuming application and victim interaction (loading the affected page) for script execution, and applications that apply their own independent output encoding are not exposed. The vendor-released fix is version 2.4.12; no public exploit code identified at time of analysis, no EPSS data was supplied, and no public CVSS score or vector (Apache and NVD both N/A) exists, so severity must be inferred from the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Cross-site scripting in Apache Sling XSS versions before 2.4.12 allows unauthenticated remote attackers to defeat the library's input-neutralization logic, so that crafted input passed through the affected encoding/filtering API is rendered unsafely in a victim's browser (user interaction required per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The impact is indirect but broad: this library is the component downstream applications call to sanitize untrusted input, so a bypass silently re-exposes every consuming application to reflected or stored XSS. No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) is reported, and the vendor has released a fix in version 2.4.12.
Denial of service in Apache Sling XSS (before 2.4.12) allows remote unauthenticated attackers to exhaust server resources by passing XML content with recursively defined DTD entities through the Sling XSS protection module, which expands them without bound. This CWE-776 XML entity expansion flaw only affects availability (no data compromise) and requires the application to route attacker-controlled XML to the vulnerable parser. No public exploit code or active exploitation has been identified, and the vendor recommends upgrading to 2.4.12.
Reflected cross-site scripting in the Apache Sling XSS library 2.4.10 and earlier arises because the XSSAPI.getValidHref() helper fails to properly neutralize certain attacker-supplied values, returning an href that a consuming application may then render into a page. Remote, unauthenticated attackers can exploit this only where a downstream application actually uses getValidHref() as its sanitizer for attacker-influenced link values and reflects that value back to users, and a victim must click a crafted link for the script to execute (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and overall risk is low because reachability depends entirely on how an embedding application wires up this method.