CVE-2017-15717

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref…

published January 10, 2018

CVSS
—
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02910 · 86.9th percentile
Published
2018-01-10T14:00Z
EPSS history
Timeline
  • 10 JAN 14:00Z
    A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref…
    cvelistv5