CVE-2020-1949

MEDIUM 6.1CVE-2020-1949 · Published 01/04/2020 · updated 17/06/2026

In short

CVE-2020-1949 is a MEDIUM (CVSS 6.1) vulnerability affecting sling cms (apache).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 80.4% of all vulnerabilities.
Fix: update to 0.16.0 or later.

Package	Affected versions	Patched versions
sling cms apache	`< 0.16.0`	`0.16.0`

Description

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.

References

s.apache.org/CVE-2020-1949 · Mailing List

More vulnerabilities in sling cms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free