CVE-2021-40722

AEM Forms Improper Restriction of XML External Entity Reference

State: Published
Severity: 9.8 Critical
Published: Jan 13, 2022
Updated: Sep 16, 2024
Reserved: Sep 8, 2021

Description

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	adobe

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Affected Products

Product	Versions
Experience ManagerAdobe	6.5.10.0 and earlierAffected None and earlierAffected

References

https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.