title: XSS in Sling CMS Reference App Taxonomy Path
description: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may allow an authenticated remote attacker to perform a reflected cross site scripting (XSS) attack in the taxonomy management feature.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
vendor: Apache Software Foundation
product: Apache Sling App CMS
versions:
version: unspecified, lessThan: 1.1.2, status: affected, versionType: custom
}
metrics:
other: [
type: unknown
content: {'other': 'low'}
]
workarounds: Upgrade to Apache Sling App CMS >= 1.1.2