Lucene search
GitHub Advisory DatabaseGHSA-JJ93-4JR5-X45HHistoryNov 02, 2022 - 7:00 p.m.
Apache Sling App CMS vulnerable to Cross-site Scripting
2022-11-0219:00:31
CWE-79
GitHub Advisory Database
github.com
6
apache sling
cms
cross-site scripting
vulnerability
remote attacker
taxonomy management
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
30.3%
A Cross-site Scripting vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
Affected configurations
Node
org.apache.sling\Matchorg.apache.sling.cms
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.apache.sling:org.apache.sling.cms | lt | 1.1.2 |
Related
osv
osv
Apache Sling App CMS vulnerable to Cross-site Scripting
2022-11-02 19:00:31
CVE-2022-43670
2022-11-02 13:15:19
veracode
veracode
Cross-Site Scripting (XSS)
2022-11-03 05:39:23
nvd
nvd
CVE-2022-43670
2022-11-02 13:15:19
cve
cve
CVE-2022-43670
2022-11-02 13:15:19
cvelist
cvelist
CVE-2022-43670 XSS in Sling CMS Reference App Taxonomy Path
2022-11-02 00:00:00
prion
prion
Cross site scripting
2022-11-02 13:15:00
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
30.3%
Related for GHSA-JJ93-4JR5-X45H