by Kastro
Paper/Archive/CVE-2020-9742

CVE-2020-9742

Adobe Experience Manager — Reflected XSS in AEM Inbox module

EPSS 2%CVSS 9.0
critical.is priorityof 100
43
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 79.0.790 × 2015.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Affected

ProductAffectedFixed inSource
Experience Managerunspecified – 6.5.5.0–CNA
Experience Managerunspecified – 6.4.8.1–CNA
Experience Managerunspecified – 6.3.3.8–CNA
Experience Managerunspecified – None–CNA

Scores by source

adobe (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/experience-manager/apsb20-56.html