CVE-2023-22849 — Apache Sling App CMS: XSS in CMS Reference / UI Components

CVE-2023-22849

Apache Sling App CMS: XSS in CMS Reference / UI Components PUBLISHED

Description (CNA)

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Sling App CMS	affected 0 before 1.1.6

CWE

CWE-79

References

https://sling.apache.org/news.html

ADP enrichment

CVE

No English description supplied.

https://sling.apache.org/news.html

CISA-ADP

No English description supplied.

No references supplied.