Description
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Remediation
References
http://packetstormsecurity.com/files/143758/Apache-Sling-Servlets-Post-2.3.20-Cross-Site-Scripting.html
http://www.securityfocus.com/archive/1/541024/100/0/threaded
http://www.securityfocus.com/bid/100284
https://issues.apache.org/jira/browse/SLING-7041
https://lists.apache.org/thread.html/2f4b8333e44c6e7e0b00933bd4204ce64829952f60dbb6814f2cdf91%40%3Cdev.sling.apache.org%3E
Related Vulnerabilities
CVE-2020-7640 Vulnerability in npm package pixl-class
CVE-2022-29249 Vulnerability in maven package io.github.javaezlib:javaez
CVE-2021-23341 Vulnerability in maven package org.webjars.npm:prismjs
CVE-2023-47327 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web
CVE-2017-5645 Vulnerability in maven package org.apache.logging.log4j:log4j-core