{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-01T08:24:59.181","vulnerabilities":[{"cve":{"id":"CVE-2022-4979","sourceIdentifier":"disclosure@vulncheck.com","published":"2025-07-25T16:15:27.230","lastModified":"2026-06-17T05:22:29.270","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected."},{"lang":"es","value":"Existe una vulnerabilidad de cross-site scripting (xss) en Sitecore Experience Platform (XP) 7.5-10.2 y CMS 7.2-7.2 Update-6 que podría permitir que usuarios autenticados de Sitecore Shell sean engañados para ejecutar código JS personalizado. Los clientes de Managed Cloud Standard que utilizan las versiones afectadas de Sitecore Experience Platform/CMS también se ven afectados."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Sitecore","product":"Experience Platform","defaultStatus":"unaffected","versions":[{"version":"7.5 Initial Release","lessThanOrEqual":"7.5 Update-2","versionType":"custom","status":"affected"},{"version":"8.0 Initial Release","lessThanOrEqual":"8.0 Update-7","versionType":"custom","status":"affected"},{"version":"8.1 Initial Release","lessThanOrEqual":"8.1 Update-3","versionType":"custom","status":"affected"},{"version":"8.2 Initial Release","lessThanOrEqual":"8.2 Update-7","versionType":"custom","status":"affected"},{"version":"9.0 Initial Release","lessThanOrEqual":"9.0 Update-2","versionType":"custom","status":"affected"},{"version":"9.1 Initial Release","lessThanOrEqual":"9.1 Update 1","versionType":"custom","status":"affected"},{"version":"9.2 Initial Release","status":"affected"},{"version":"9.3 Initial Release","status":"affected"},{"version":"10.0 Initial Release","lessThanOrEqual":"10.0 Update-3","versionType":"custom","status":"affected"},{"version":"10.1 Initial Release","lessThanOrEqual":"10.1 Update-2","versionType":"custom","status":"affected"},{"version":"10.2 Initial Release","status":"affected"}]},{"vendor":"Sitecore","product":"Content Mangement System (CMS)","defaultStatus":"unaffected","versions":[{"version":"7.2 Initial Release","lessThanOrEqual":"7.2 Update-6","versionType":"custom","status":"affected"}]},{"vendor":"Sitecore","product":"Managed Cloud","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-25T17:39:41.562664Z","id":"CVE-2022-4979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001489","source":"disclosure@vulncheck.com"},{"url":"https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1001539","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/sitecore-xp-cms-managed-cloud-xss","source":"disclosure@vulncheck.com"}]}}]}