VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago

CVE-2016-5394

6.1 Medium No exploit published

Description

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

CWE-79 · Cross-site scripting

Exploitation Status

No public exploit

Nothing published shows this CVE being exploited. The 1 repository below are public repositories under the 5-star bar: published, but with nobody other than their authors having looked.

CVSS E:U

  • CISA KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2024-05-31.
  • EPSS 2.6% chance in 30 days

1 of these are GitHub repositories below the 5★ evidence bar. They are listed because a person may still want to open one; they do not count toward the exploit maturity above.

IndexArtifactStarsFirst seen
GitHub PoC apache/sling with CVE-2016-5394 2024-05-31

Waratek Defense Posture

No exploit published

In RASP's scope with an upstream fix path, but nobody has published a working exploit. That is a statement about what has been published, not a finding that the defect is unreachable or unimportant.

  • Protection none
  • Action unverified patch rule
  • Review automated upstream-data
  • Record active
Decided by below-action-threshold : Medium or Low severity, no KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory
Finding This CVE is MEDIUM severity, is not listed in CISA KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain.

CVSS

6.1 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.3 no band published AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected Software & Releases

☕ Maven Library Packages

Artifact coordinates and fix boundaries from OSV.dev
Package CoordinateIntroducedFixedLast affected
org.apache.sling:org.apache.sling.xss 0 1.0.12 unbounded
org.apache.sling:org.apache.sling.xss.compat 0 1.1.0 unbounded

🖥️ Product CPEs & Version Ranges

3 product(s) over 3 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd apache sling generic ＜ 1.0.12
osv org.apache.sling org.apache.sling.xss generic ＜ 1.0.12
osv org.apache.sling org.apache.sling.xss.compat generic ＜ 1.1.0

References

URLTags
https://github.com/apache/sling-org-apache-sling-xss/commit/de32b144ad2be3367559f6184d560db42a220529 WEB
https://github.com/jensdietrich/xshady-release/tree/main/CVE-2016-5394 WEB
https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525@%3Cdev.sling.apache.org%3E WEB
http://www.securityfocus.com/bid/99870 WEB
https://lists.apache.org/thread.html/332166037a54b97cf41e2b616aaed38439de94b19b204841478e4525%40%3Cdev.sling.apache.org%3E

Timeline

Published 2017-07-19 Last modified 2026-06-17
Published2017-07-19By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.