CVE-2017-9802

CVE-2017-9802 describes a Cross-Site Scripting (XSS) vulnerability in Apache Sling Servlets Post versions prior to 2.3.22. The vulnerability arises from the Sling.evalString() Javascript method's use of the 'eval' function to parse input, allowing attackers to inject malicious scripts. This medium-severity vulnerability (CVSS 6.1) can be exploited remotely with low attack complexity, requiring user interaction. A successful attack could lead to information disclosure and integrity compromise. Despite its potential impact, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The CVE has also received minimal community discussion or media coverage.