CVE-2020-1949

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.

Score

CVSS 3.1 6.1 Medium

Status

Modified - security@apache.org

Published

2020-04-01

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Sling Cms (Apache)

References

• https://s.apache.org/CVE-2020-1949