CVE-2020-9733CWE-200

Sensitive information disclosure possible in AEM

High · published September 10, 2020

CVSS v3.1
7.5
EPSS
4%
Percentile
89.8
In the wild
Unconfirmed
What it is

An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03751 · 89.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2020-09-10T16:34Z
EPSS history
Timeline
  • 10 SEP 16:34Z
    Sensitive information disclosure possible in AEM
    cvelistv5