Medium severity6.1NVD Advisory· Published Jan 10, 2018· Updated Jun 17, 2026
CVE-2017-15717
CVE-2017-15717
Description
A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.sling:org.apache.sling.xssMaven | >= 1.0.4, < 2.0.4 | 2.0.4 |
Affected products
6cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*range: >1.0.4,<=1.0.18
- cpe:2.3:a:apache:sling_xss_protection_api:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:sling_xss_protection_api_compat:1.1.0:*:*:*:*:*:*:*
- ghsa-coords2 versionspkg:maven/org.apache.sling/org.apache.sling.xsspkg:maven/org.apache.sling/org.apache.sling.xss.compat
>= 1.0.4, < 2.0.4+ 1 more
- (no CPE)range: >= 1.0.4, < 2.0.4
- (no CPE)
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-7mfw-43c4-45mqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-15717ghsaADVISORY
- s.apache.org/CVE-2017-15717nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.