-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability specifically affects the site group feature in Apache Sling CMS, indicating input from authenticated users is reflected back without proper sanitization. Reflected XSS typically occurs when request parameters are directly embedded in responses. The SiteGroupServlet would be the logical handler for site group operations, and the doGet method is a common entry point for HTTP GET requests. While exact code isn't available, the pattern matches classic XSS vulnerabilities in Java servlets where request parameters (like group identifiers or names) are echoed in responses without using output encoding utilities like OWASP Encoder or ESAPI.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.sling:org.apache.sling.cms | maven | < 1.1.4 | 1.1.4 |
Ongoing coverage of React2Shell