Düşük
CVE-2026-103863: CVE-2026-103863: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Özet bilgiler
- EPSS
- %0,23 (yüzdelik 14)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor