CVE-2022-28820
Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution
- State
- Published
- Severity
- 6.1 Medium
- Published
- Apr 21, 2022
- Updated
- Sep 17, 2024
- Reserved
- Apr 8, 2022
Description
ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | adobe |
Weaknesses
- CWE-79 Cross-site Scripting (Reflected XSS) (CWE-79)
Affected Products
| Product | Versions |
|---|---|
Experience ManagerAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.