CVE-2022-46769
Assigner: apache
Published: 2023-01-09T10:14:56.823Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Sling App CMS
vendor: Apache Software Foundation
versions: lessThan: 1.1.4
status: affected
version: 0
versionType: custom
credits: type: finder
value: Apache Sling would like to thank Sam Bagheri for reporting this issue
descriptions: supportingMedia: base64: no
type: text/html
value: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.<br><br><span style="background-color: rgb(255, 255, 255);">Upgrade to Apache Sling App CMS &gt;= 1.1.4</span> <br>
value: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.

Upgrade to Apache Sling App CMS >= 1.1.4 

metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
type: CWE
source: discovery: EXTERNAL
title: Apache Sling App CMS: XSS in CMS Site Group Detail
x_generator: engine: Vulnogram 0.1.0-dev