CVE-2022-43670: XSS in Sling CMS Reference App Taxonomy Path

Security readout for executives and security teams

CVE-2022-43670 is a reflected cross-site scripting issue in Apache Sling App CMS taxonomy management. An authenticated attacker could craft input that is reflected into a page, potentially causing script execution when another user interacts with it. The published severity is medium, and the source bundle does not show active exploitation. Exposure is likely limited to organizations running Apache Sling App CMS 1.1.0 or earlier with authenticated users who can reach taxonomy management functionality. Handle through normal vulnerability management unless the application is internet-facing or broadly accessible to many authenticated users. Prioritize higher if CMS users include untrusted accounts. Mitigation focus: Inventory Apache Sling App CMS deployments and identify versions at or below 1.1.0.; Check Apache advisory guidance for the appropriate supported remediation or upgrade path.; Restrict taxonomy management access to trusted authenticated users until remediated..

Prepared

May 25, 2026, 14:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.