Not rated
CVE-2022-43670 An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in…
Description
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Sling App CMS 1.1 | earliest → < 1.1.2 | 1.1.2 |
References
- lists.apache.org lists.apache.org
- [oss-security] 20221102 CVE-2022-43670: Apache Sling App CMS: XSS in Sling CMS Reference App Taxonomy Path www.openwall.com
Timeline
- Published
- Last modified