Vulnerability · Published Sep 10, 2020 · Assigned by adobe
CVE-2020-9743HTML injection in AEM's content editor component
Medium 5.3
In plain English
A medium-severity improper input validation in Experience Manager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities).
Official description
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Experience Manager | unspecified – through 6.5.5.0unspecified – through 6.4.8.1unspecified – through 6.3.3.8unspecified – through 6.2 SP1-CFP20 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N