medium5.4
CVE-2022-43670
Apache Sling App CMS vulnerable to Cross-site Scripting
Impact
A Cross-site Scripting vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.sling:org.apache.sling.cms | < 1.1.2 | 1.1.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Sling Cms | through 1.1.0 |