2 lines
1.2 KiB
JSON
2 lines
1.2 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.sling:org.apache.sling.xss","packageURL":"pkg:maven/org.apache.sling/org.apache.sling.xss","product":"Apache Sling XSS","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.4.14","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.14.\n\n\n\nUsers are recommended to upgrade to version 2.4.14, which fixes the issue."}],"id":"CVE-2026-123765","lastModified":"2026-11-12T10:17:28.523","metrics":{},"published":"2026-11-12T10:17:28.523","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/ddvvg034rwqpnsqz8sw0rldyqqoh9c92"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@apache.org","type":"Primary"}]}
|