Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2022-4979

Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sitecore Experience Platform

Default version status: unaffected

  • 7.5 Initial Release to ≤ 7.5 Update-2affected
  • 8.0 Initial Release to ≤ 8.0 Update-7affected
  • 8.1 Initial Release to ≤ 8.1 Update-3affected
  • 8.2 Initial Release to ≤ 8.2 Update-7affected
  • 9.0 Initial Release to ≤ 9.0 Update-2affected
  • 9.1 Initial Release to ≤ 9.1 Update 1affected
  • 9.2 Initial Releaseaffected
  • 9.3 Initial Releaseaffected
  • 10.0 Initial Release to ≤ 10.0 Update-3affected
  • 10.1 Initial Release to ≤ 10.1 Update-2affected
  • 10.2 Initial Releaseaffected

Sitecore Content Mangement System (CMS)

Default version status: unaffected

  • 7.2 Initial Release to ≤ 7.2 Update-6affected

Sitecore Managed Cloud

Default version status: unaffected

  • *affected

References