CVE-2017-15717
Summary
| CVE | CVE-2017-15717 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-01-10 14:29:00 UTC |
| Updated | 2018-02-02 18:43:00 UTC |
| Description | A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Sling Xss Protection Api | 2.0.0 | All | All | All |
| Application | Apache | Sling Xss Protection Api | 2.0.0 | All | All | All |
| Application | Apache | Sling Xss Protection Api | All | All | All | All |
| Application | Apache | Sling Xss Protection Api Compat | 1.1.0 | All | All | All |
| Application | Apache | Sling Xss Protection Api Compat | 1.1.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | MLIST | s.apache.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.