by Kastro
Paper/Archive/CVE-2020-9734

CVE-2020-9734

Adobe Experience Manager — Stored XSS in AEM Forms component

EPSS 2%CVSS 9.0
critical.is priorityof 100
43
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 79.5.795 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.1 (and below) is affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Forms component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Affected

ProductAffectedFixed inSource
Experience Managerunspecified – Forms SP5 add-on for AEM 6.5.5.0–CNA
Experience Managerunspecified – Forms SP8 add-on for AEM 6.4.8.1–CNA
Experience Managerunspecified – None–CNA

Scores by source

adobe (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/experience-manager/apsb20-56.html