Description
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Remediation
References
http://www.securityfocus.com/bid/99870
https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2021-21179 Vulnerability in maven package org.webjars.npm:electron
CVE-2020-7701 Vulnerability in npm package madlib-object-utils
CVE-2020-13936 Vulnerability in maven package org.apache.velocity:velocity-engine-core
CVE-2019-16546 Vulnerability in maven package org.jenkins-ci.plugins:google-compute-engine