CVE-2022-43670

CVE-2022-43670: XSS in Sling CMS Reference App Taxonomy Path

Vendor Apache Software Foundation

Product Apache Sling App CMS

Weakness CWE-79 · XSS

Published November 2, 2022

Last update May 2, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.

Key dates

02Disclosure timeline

November 2, 2022 CVE published

May 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-43670 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-10685 Contact Form 7 Redirect & Thank You Page <= 1.0.6 - Reflected Cross-Site Scripting CVE-2022-20788 Cisco Unified Communications Products Cross-Site Scripting Vulnerability CVE-2019-25148 WP HTML Mail < 2.9.1 - HTML Injection CVE-2023-30491 WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) CVE-2025-9722 Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scripting