CVE-2017-9802

Name of the Vulnerable Software and Affected Versions Apache Sling Servlets Post versions prior to 2.3.22

Description The issue concerns the Javascript method Sling.evalString() which uses the javascript eval function to parse input strings. This allows for XSS attacks by passing specially crafted input strings.

Recommendations For versions prior to 2.3.22, update to version 2.3.22 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Sling.evalString() method to minimize the risk of exploitation.