CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for…

published July 19, 2017

CVSS
—
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02604 · 85.2th percentile
Published
2017-07-19T15:00Z
EPSS history
Timeline
  • 19 JUL 15:00Z
    In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for…
    cvelistv5