CVE-2021-21043

Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools

State: Published
Severity: 6.1 Medium
Published: Feb 2, 2021
Updated: Sep 17, 2024
Reserved: Dec 18, 2020

Description

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	adobe

Weaknesses

CWE-79 Cross-site Scripting (Reflected XSS) (CWE-79)

Affected Products

Product	Versions
Experience ManagerAdobe	4.9.2 and earlierAffected None and earlierAffected

References

https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-f92j-qf46-p6vm

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.