« Volver al listado

CVE-2022-4979

Estado: AplazadaMedia (5.1)—

A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sitecore — CMSAISitecore — Experience PlatformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-4979",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-4979",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-25T17:39:41.562664Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Sitecore",
          "product": "Experience Platform",
          "versions": [
            {
              "status": "affected",
              "version": "7.5 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "7.5 Update-2"
            },
            {
              "status": "affected",
              "version": "8.0 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "8.0 Update-7"
            },
            {
              "status": "affected",
              "version": "8.1 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "8.1 Update-3"
            },
            {
              "status": "affected",
              "version": "8.2 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "8.2 Update-7"
            },
            {
              "status": "affected",
              "version": "9.0 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "9.0 Update-2"
            },
            {
              "status": "affected",
              "version": "9.1 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "9.1 Update 1"
            },
            {
              "status": "affected",
              "version": "9.2 Initial Release"
            },
            {
              "status": "affected",
              "version": "9.3 Initial Release"
            },
            {
              "status": "affected",
              "version": "10.0 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "10.0 Update-3"
            },
            {
              "status": "affected",
              "version": "10.1 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "10.1 Update-2"
            },
            {
              "status": "affected",
              "version": "10.2 Initial Release"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sitecore",
          "product": "Content Mangement System (CMS)",
          "versions": [
            {
              "status": "affected",
              "version": "7.2 Initial Release",
              "versionType": "custom",
              "lessThanOrEqual": "7.2 Update-6"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sitecore",
          "product": "Managed Cloud",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-25T16:15:27.230",
  "references": [
    {
      "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001489",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001539",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/sitecore-xp-cms-managed-cloud-xss",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de cross-site scripting (xss) en Sitecore Experience Platform (XP) 7.5-10.2 y CMS 7.2-7.2 Update-6 que podría permitir que usuarios autenticados de Sitecore Shell sean engañados para ejecutar código JS personalizado. Los clientes de Managed Cloud Standard que utilizan las versiones afectadas de Sitecore Experience Platform/CMS también se ven afectados."
    }
  ],
  "lastModified": "2026-06-17T05:22:29.270",
  "sourceIdentifier": "disclosure@vulncheck.com"
}