CVE-2020-9742
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Adobe | Experience Manager | unspecified <= 6.5.5.0 | affected |
| Adobe | Experience Manager | unspecified <= 6.4.8.1 | affected |
| Adobe | Experience Manager | unspecified <= 6.3.3.8 | affected |
| Adobe | Experience Manager | unspecified <= None | affected |
Weaknesses
- CWE-79: Cross-site Scripting (XSS) (CWE-79)
ADP Enrichment
CVE Program Container
Additional References
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.