{"id":"CVE-2022-4979","aliases":["EUVD-2022-55211","GHSA-9q4g-35mh-2r24"],"status":"published","title":"Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS","description":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00721,"percentile":0.54243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-25T15:55:36Z","modified":"2026-06-17T05:22:29Z","products":[{"vendor":"sitecore","product":"content mangement system (cms)"},{"vendor":"sitecore","product":"experience platform"},{"vendor":"sitecore","product":"managed cloud"}],"references":[{"url":"https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1001489","tags":["vendor-advisory","patch"]},{"url":"https://support.sitecore.com/kb?id=kb_article_view\u0026sysparm_article=KB1001539","tags":["vendor-advisory","patch"]},{"url":"https://www.vulncheck.com/advisories/sitecore-xp-cms-managed-cloud-xss","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4979"},{"url":"https://github.com/advisories/GHSA-9q4g-35mh-2r24"}],"sources":{"cve":[{"id":"CVE-2022-4979","title":"Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS","description":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.","status":"published","published":"2025-07-25T15:55:36.039Z","modified":"2026-03-23T15:43:29.702Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-55211","description":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.","status":"published","published":"2025-07-25T15:55:36Z","modified":"2026-03-23T15:43:29Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:31.168902Z"}],"ghsa":[{"id":"GHSA-9q4g-35mh-2r24","title":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2...","description":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.","status":"published","published":"2025-07-25T18:30:38Z","modified":"2025-07-25T18:30:47Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:03:07.428711Z"}],"nvd":[{"id":"CVE-2022-4979","description":"A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.","status":"published","published":"2025-07-25T16:15:27.23Z","modified":"2026-06-17T05:22:29.27Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:43.071398Z"}]}}