CVE-2021-40722: critical vulnerability in Adobe Experience Manager
AEM Forms Improper Restriction of XML External Entity Reference
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 3.3%
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · Experience ManagerRelated CVEs — Adobe Experience Manager
In the same product, most dangerous first.
CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2020-9733HIGHSensitive information disclosure possible in AEMEPSS 3.8%CVE-2021-21043MEDIUMReflected Cross-site Scripting (XSS) on version-compare and page-compare toolsEPSS 3.4%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2020-24444MEDIUMBlind SSRF in Forms add-on for AEMEPSS 2.1%CVE-2021-21083HIGHAdobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-serviceEPSS 2.0%