Cross site scripting in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

Vulnerability ID: GHSA-xwf4-88xr-hx2j
Aliases: CVE-2016-5394
Published: 2022-05-13 01:25:29
CWE: CWE-79
Severity rating: MODERATE
CVSS: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven
name: org.apache.sling:org.apache.sling.xss
package: ecosystem: Maven
name: org.apache.sling:org.apache.sling.xss.compat