CVE-2022-4979

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

CVSS

No CVSS.

References

Link	Resource
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001489
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001539
https://www.vulncheck.com/advisories/sitecore-xp-cms-managed-cloud-xss

Configurations

No configuration.

History

29 Jul 2025, 14:14

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de cross-site scripting (xss) en Sitecore Experience Platform (XP) 7.5-10.2 y CMS 7.2-7.2 Update-6 que podría permitir que usuarios autenticados de Sitecore Shell sean engañados para ejecutar código JS personalizado. Los clientes de Managed Cloud Standard que utilizan las versiones afectadas de Sitecore Experience Platform/CMS también se ven afectados.

25 Jul 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-25 16:15

Updated : 2025-07-29 14:14

NVD link : CVE-2022-4979

Mitre link : CVE-2022-4979

CVE.ORG link : CVE-2022-4979

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-4979", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-25T16:15:27.230", "references": [{"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001489", "source": "disclosure@vulncheck.com"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001539", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sitecore-xp-cms-managed-cloud-xss", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (xss) en Sitecore Experience Platform (XP) 7.5-10.2 y CMS 7.2-7.2 Update-6 que podr\u00eda permitir que usuarios autenticados de Sitecore Shell sean enga\u00f1ados para ejecutar c\u00f3digo JS personalizado. Los clientes de Managed Cloud Standard que utilizan las versiones afectadas de Sitecore Experience Platform/CMS tambi\u00e9n se ven afectados."}], "lastModified": "2025-07-29T14:14:55.157", "sourceIdentifier": "disclosure@vulncheck.com"}