Apache Sling Cms vulnerabilities
4 known vulnerabilities affecting apache/sling_cms.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2023-22849MEDIUMCVSS 6.1fixed in 1.1.62023-02-04
CVE-2023-22849 [MEDIUM] CWE-79 CVE-2023-22849: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vul
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features.
Upgrade to Apache Sling App CMS >= 1.1.6
nvd
CVE-2022-46769MEDIUMCVSS 5.4fixed in 1.1.42023-01-09
CVE-2022-46769 [MEDIUM] CWE-79 CVE-2022-46769: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vul
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.
Upgrade to Apache Sling App CMS >= 1.1.4
nvd
CVE-2022-43670MEDIUMCVSS 5.4≤ 1.1.02022-11-02
CVE-2022-43670 [MEDIUM] CWE-79 CVE-2022-43670: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vul
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
nvd
CVE-2020-1949MEDIUMCVSS 6.1fixed in 0.16.02020-04-01
CVE-2020-1949 [MEDIUM] CWE-79 CVE-2020-1949: Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generati
Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.
nvd