CVE-2023-22849

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-22849

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22849.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-22849

Aliases

GHSA-rghh-ghf7-7943

Published

2023-02-04T21:15:09Z

Modified

2024-09-03T04:13:09.294512Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features.

Upgrade to Apache Sling App CMS >= 1.1.6

References

https://sling.apache.org/news.html

Affected packages

Git / github.com/apache/sling-org-apache-sling-app-cms

Affected ranges

Type: GIT
Repo: https://github.com/apache/sling-org-apache-sling-app-cms
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

e041ccddb2369b71668d36c78b3f19739557873a

Affected versions

org.*

org.apache.sling.cms-0.10.0

org.apache.sling.cms-0.11.0

org.apache.sling.cms-0.11.2

org.apache.sling.cms-0.12.0

org.apache.sling.cms-0.14.0

org.apache.sling.cms-0.16.0

org.apache.sling.cms-0.16.2

org.apache.sling.cms-1.0.2

org.apache.sling.cms-1.0.4

org.apache.sling.cms-1.1.0

org.apache.sling.cms-1.1.2

org.apache.sling.cms-1.1.4