vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-15717

N/A
Published: January 10, 2018 at 02:00 PM UTC
Updated: June 17, 2026 at 01:08 AM UTC
3 products affected across 1 vendorSling Xss Protection APISling Xss Protection API CompatApache Sling

Using Apache Sling by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Sling - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 3%

Description

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Sling Xss Protection API· Apache
95%
1.0.4 < v ≤ 1.0.182.0.0
Sling Xss Protection API Compat· Apache
95%
1.1.0
Apache Sling· Apache
60%
v ≤ 1.0.18XSS Protection API 2.0.0XSS Protection API Compat 1.1.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Mailing Listx_refsource_MLISTVendor Advisory
Source: [email protected]
https://s.apache.org/CVE-2017-15717

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card