CVE-2020-9735: falha de média gravidade em Adobe Experience Manager
Stored XSS in AEM's Content Repository Development Environment
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 1.8%
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when search queries return the page containing the vulnerable field.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Adobe · Experience ManagerCVEs relacionadas — Adobe Experience Manager
No mesmo produto, das mais perigosas para as menos.
CVE-2022-28851MEDIUMAEM Reflected XSS Arbitrary code executionEPSS 36.8%CVE-2020-9733HIGHSensitive information disclosure possible in AEMEPSS 3.8%CVE-2021-21043MEDIUMReflected Cross-site Scripting (XSS) on version-compare and page-compare toolsEPSS 3.4%CVE-2021-40722CRITICALAEM Forms Improper Restriction of XML External Entity ReferenceEPSS 3.3%CVE-2020-9732CRITICALStored XSS in AEM Sites ComponentsEPSS 2.8%CVE-2020-24444MEDIUMBlind SSRF in Forms add-on for AEMEPSS 2.1%