Description
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Remediation
References
http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/541024/100/0/threaded
http://www.securityfocus.com/bid/100284
https://issues.apache.org/jira/browse/SLING-7041
https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2016-0762 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2016-10735 Vulnerability in npm package bootstrap-sass
CVE-2023-45133 Vulnerability in npm package @babel/traverse
CVE-2023-26492 Vulnerability in npm package directus
CVE-2020-36641 Vulnerability in maven package fr.turri:axmlrpc