Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools (Adobe Experience Manager)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.38 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | adobe |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-7r83-w6r8-fh6w — Reflected Cross-site Scripting (XSS) in ACS Commons
- GHSA-f92j-qf46-p6vm — Reflected Cross-site Scripting in ACS Commons
European references
- ENISA EUVD · EUVD-2021-1005
- GCVE · GCVE-0-2021-21043
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:adobe_consulting_services_commons:*:*:*:*:*:*:*:*≤ 4.9.2
Affected products
| Product | Versions |
|---|---|
| Adobe · Experience Manager | affected unspecified ≤ 4.9.2 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |