CVE-2022-46769

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-46769

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-46769.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-46769

Aliases

GHSA-38m2-vr6g-8c94

Published

2023-01-09T11:15:10Z

Modified

2024-09-03T04:21:04.455243Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.

Upgrade to Apache Sling App CMS >= 1.1.4

References

https://sling.apache.org/news.html

Affected packages

Git / github.com/apache/sling-org-apache-sling-app-cms

Affected ranges

Type: GIT
Repo: https://github.com/apache/sling-org-apache-sling-app-cms
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d7b35100703f7a3445439deaf7d280ad0eea7dac

Affected versions

org.*

org.apache.sling.cms-0.10.0

org.apache.sling.cms-0.11.0

org.apache.sling.cms-0.11.2

org.apache.sling.cms-0.12.0

org.apache.sling.cms-0.14.0

org.apache.sling.cms-0.16.0

org.apache.sling.cms-0.16.2

org.apache.sling.cms-1.0.2

org.apache.sling.cms-1.0.4

org.apache.sling.cms-1.1.0

org.apache.sling.cms-1.1.2