Description
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Remediation
References
http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/541024/100/0/threaded
http://www.securityfocus.com/bid/100284
https://issues.apache.org/jira/browse/SLING-7041
https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2020-11972 Vulnerability in maven package org.apache.camel:camel-rabbitmq
CVE-2018-19839 Vulnerability in npm package node-sass
CVE-2014-10065 Vulnerability in npm package remarkable
CVE-2022-3171 Vulnerability in maven package com.google.protobuf:protobuf-javalite
CVE-2020-24025 Vulnerability in maven package org.webjars.npm:node-sass