-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies XSSAPI.encodeForJSString() as the problematic method. The commit diff shows the patched version changed from Encode.forJavaScriptSource() to Encode.forJavaScript() with additional hyphen encoding, confirming the original implementation was insufficient. The CVE and advisory both directly reference this method's encoding weakness as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.sling:org.apache.sling.xss | maven | < 1.0.12 | 1.0.12 |
| org.apache.sling:org.apache.sling.xss.compat | maven | < 1.1.0 | 1.1.0 |