Description
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Remediation
References
http://www.securityfocus.com/bid/99870
https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2018-8003 Vulnerability in maven package org.apache.ambari:ambari-server
CVE-2019-10792 Vulnerability in npm package bodymen
CVE-2023-41835 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2017-12617 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.validation