Apache Sling Servlets Post vulnerabilities

2 CVEs affecting Apache Sling Servlets Post, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-9802, published 2017-08-14.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2944, published 2015-06-02. Medium severity, CVSS 4.3. EPSS: 6.3% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the…
• CVE-2017-9802, published 2017-08-14. Medium severity, CVSS 6.1. EPSS: 3.7% chance of exploitation in the next 30 days. The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially…