Description
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Remediation
References
http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/541024/100/0/threaded
http://www.securityfocus.com/bid/100284
https://issues.apache.org/jira/browse/SLING-7041
https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2016-10568 Vulnerability in npm package geoip-lite-country
CVE-2017-5664 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2019-10380 Vulnerability in maven package org.jenkins-ci.plugins:simple-travis-runner
CVE-2019-10782 Vulnerability in maven package com.puppycrawl.tools:checkstyle
CVE-2020-2254 Vulnerability in maven package io.jenkins.blueocean:blueocean-parent