Read the docs
TI-2022-23127 Aliases CVE-2022-46769GHSA-38m2-vr6g-8c94

Apache Sling App CMS: XSS in CMS Site Group Detail

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0142 72nd percentileScored 2026-11-07
Fix Fixed Apache Sling App CMS (Apache Software Foundation): 1.1.4org.apache.sling:org.apache.sling.cms (Maven): 1.1.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Sling App CMSbefore 1.1.41.1.4Patch availableCNA
—org.apache.sling:org.apache.sling.cms (Maven)before 1.1.41.1.4Patch availableGHSA-38m2-vr6g-8c94
  • Apache Sling App CMS VendorApache Affected before 1.1.4 Fixed in 1.1.4 Patch available CNA
  • org.apache.sling:org.apache.sling.cms (Maven) Vendor— Affected before 1.1.4 Fixed in 1.1.4 Patch available GHSA-38m2-vr6g-8c94

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:sling_cms:*:*:*:*:*:*:*:*before 1.1.4VulnerableApache
  • cpe:2.3:a:apache:sling_cms:*:*:*:*:*:*:*:* Versions before 1.1.4 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Sling App CMS (Apache Software Foundation) Fixed in 1.1.4
  • Fix · GHSA-38m2-vr6g-8c94 org.apache.sling:org.apache.sling.cms (Maven) Fixed in 1.1.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46769
  2. 2026-10-03 Alias added: GHSA-38m2-vr6g-8c94

References

Advisory 2

Other 1

  • TI-2020-01873 Cross-site scripting in Apache Sling CVSS 3.1MEDIUM 6.1
  • TI-2023-09003 Apache Sling App CMS: XSS in CMS Reference / UI Components CVSS 3.1MEDIUM 6.1
  • TI-2022-21433 XSS in Sling CMS Reference App Taxonomy Path CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences