CVE-2023-22849

CVSS v3.1 6.1 (Medium)

EPSS 0.24 % (65^th)

Affected Products 1

Advisories 1

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features.

Upgrade to Apache Sling App CMS >= 1.1.6

Weaknesses

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE Status: PUBLISHED
CNA: Apache Software Foundation
Published Date: 2023-02-04 21:15:09
(19 months ago)
Updated Date: 2023-11-07 04:07:28
(10 months ago)

Affected Products

Apache

Sling Cms

Configuration #1

		CPE23	From	Up To
	Apache Sling Cms prior 1.1.6 version	cpe:2.3:a:apache:sling_cms		< 1.1.6