CVE-2017-15717 Cross-site Scripting in Apache Sling XSS Protection API
Attackers can inject XSS payloads via crafted URLs due to improper validation in the Apache Sling XSS Protection API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-15717?
CVE-2017-15717 is a medium-severity cross-site scripting vulnerability in Apache Sling, published on 10 Jan 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Weakness: CWE-79
Which versions are affected by CVE-2017-15717?
4 open source packages ship an affected version, including org.apache.sling:org.apache.sling.xss and org.apache.sling:org.apache.sling.xss.compat. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.sling:org.apache.sling.xss Maven | From 1.0.4 | 2.0.4 |
org.apache.sling:org.apache.sling.xss Maven | From 1.0.4 | 2.0.4 |
org.apache.sling:org.apache.sling.xss.compat Maven | All versions | None |
org.apache.sling:org.apache.sling.xss.compat Maven | All versions | None |
Products include Apache Sling Xss Protection Api, Apache Sling Xss Protection Api Compat.
How do I fix CVE-2017-15717?
Upgrade org.apache.sling:org.apache.sling.xss to 2.0.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-15717 being exploited?
There is no known exploitation of CVE-2017-15717 in the wild and no public exploit code.
Other vulnerabilities in Apache Sling
- CVE-2026-73192 Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
- CVE-2026-91852 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
- CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
- CVE-2026-91999 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
- CVE-2026-92001 Apache Sling XSS: Missing parser resource limits
Sources
Also known as GHSA-7mfw-43c4-45mq.