Description
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.
Remediation
References
http://www.securityfocus.com/bid/99873
https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2015-8857 Vulnerability in maven package org.webjars.npm:uglify-js
CVE-2020-7642 Vulnerability in maven package org.webjars.npm:lazysizes
CVE-2018-18893 Vulnerability in maven package com.hubspot.jinjava:jinjava
CVE-2022-36911 Vulnerability in maven package org.jenkins-ci.plugins:openstack-heat
CVE-2020-2213 Vulnerability in maven package org.jenkins-ci.plugins:whitesource