Vulnerability · Published Sep 16, 2022 · Assigned by adobe
CVE-2022-30684AEM Reflected XSS Arbitrary code execution
Medium 5.4
In plain English
A medium-severity cross-site scripting in Experience Manager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Experience Manager | unspecified – through 6.5.13.0unspecified – through None |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N