Apache Sling CMS vulnerabilities

4 CVEs affecting Apache Sling CMS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-22849, published 2023-02-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-1949, published 2020-04-01. Medium severity, CVSS 6.1. EPSS: 2% chance of exploitation in the next 30 days. Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS…
CVE-2022-43670, published 2022-11-02. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to…
CVE-2023-22849, published 2023-02-04. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to…
CVE-2022-46769, published 2023-01-09. Medium severity, CVSS 5.4. EPSS: 1.4% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to…