CVE-2023-22849 — Apache Sling App CMS: XSS in CMS Reference / UI Components
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticate…
Published: 2023-02-04 · CVSS: 6.1 · CVSS 3.1
An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7