Cross-site scripting in Apache Sling
Priority LOW 33CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Why it matters now
EPSS 0.0291 87th percentileScored 2026-11-07
Fix Fixed org.apache.sling:org.apache.sling.xss (Maven): 2.0.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Sling | XSS Protection API 1.0.4 to 1.0.18; XSS Protection API Compat 1.1.0; XSS Protection API 2.0.0 | — | No fix listed | CNA |
| — | org.apache.sling:org.apache.sling.xss (Maven) | 1.0.4 to before 2.0.4 | 2.0.4 | Patch available | GHSA-7mfw-43c4-45mq |
| — | org.apache.sling:org.apache.sling.xss.compat (Maven) | — | — | No fix listed | GHSA-7mfw-43c4-45mq |
- Apache Sling VendorApache Affected XSS Protection API 1.0.4 to 1.0.18; XSS Protection API Compat 1.1.0; XSS Protection API 2.0.0 Fixed in — No fix listed CNA
- org.apache.sling:org.apache.sling.xss (Maven) Vendor— Affected 1.0.4 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-7mfw-43c4-45mq
- org.apache.sling:org.apache.sling.xss.compat (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-7mfw-43c4-45mq
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:* | after 1.0.4, up to 1.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:sling_xss_protection_api:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:sling_xss_protection_api_compat:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:* Versions after 1.0.4, up to 1.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:sling_xss_protection_api:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:sling_xss_protection_api_compat:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apache
Remediation
- Fix · GHSA-7mfw-43c4-45mq org.apache.sling:org.apache.sling.xss (Maven) Fixed in 2.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-15717
- 2026-10-03 Alias added: GHSA-7mfw-43c4-45mq
References
More Apache Sling Xss Protection Api vulnerabilities
- TI-2026-62045 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl CVSS 3.1MEDIUM 6.1
- TI-2026-62131 Apache Sling XSS: Missing parser resource limits CVSS 3.1MEDIUM 6.1
- TI-2026-62129 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin CVSS 3.1MEDIUM 6.1
- TI-2026-62063 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms CVSS 3.1MEDIUM 6.1
- TI-2026-51337 Apache Sling XSS: XSS possible through XSSAPI.getValidHref() CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-15717 · CVE Program
- CVE-2017-15717 · NVD
- FIRST EPSS
- GHSA-7mfw-43c4-45mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences