com.activecq.tools.quickimage:core (1.0.0), com.adobe.cq.commerce:cq-commerce-core (>=5.13.0, <=5.13.18) +29 more potentially affected by CVE-2017-9802 via org.apache.sling:org.apache.sling.servlets.post (>=2.0.4-incubator, <=2.3.16)

org.apache.sling:org.apache.sling.servlets.post MAVEN version =2.0.4-incubator, =5.13.0, =5.5.0, =5.6.2, =5.5.0, =5.5.74, =1.7.0, =5.3.0, =5.3.0, =5.4.0, =5.5.0, =1.0.8, =1.0.12 and more Source cves: CVE-2017-9802 Source advisory: MEND:CVE-2017-9802...

CVE-2017-9802

CVE-2017-9802 affects Apache Sling Servlets Post prior to version 2.3.22. The vulnerability arises from using the Javascript function eval on input strings in Sling.evalString(), enabling cross-site scripting (XSS). Impact is XSS through crafted input strings; affected version is 2.3.20 (and olde...