Description
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Remediation
References
http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/541024/100/0/threaded
http://www.securityfocus.com/bid/100284
https://issues.apache.org/jira/browse/SLING-7041
https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2016-5016 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-server
CVE-2022-23223 Vulnerability in maven package org.apache.shenyu:shenyu-common
CVE-2021-28918 Vulnerability in npm package netmask
CVE-2018-14041 Vulnerability in maven package org.webjars:bootstrap
CVE-2013-2165 Vulnerability in maven package org.richfaces.framework:richfaces-impl-jsf2