by Kastro
Paper/Archive/CVE-2020-9732

CVE-2020-9732

Adobe Experience Manager — Stored XSS in AEM Sites Components

EPSS 3%CVSS 9.0
critical.is priorityof 100
44
CVSS 9.0 (CNA, NVD agree)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 86.5.865 × 2017.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Affected

ProductAffectedFixed inSource
Experience Managerunspecified – Forms SP5 add-on for AEM 6.5.5.0–CNA
Experience Managerunspecified – Forms SP8 add-on for AEM 6.4.8.1–CNA
Experience Managerunspecified – None–CNA

Scores by source

adobe (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/experience-manager/apsb20-56.html