CVE-2020-9736CWE-79

Stored XSS in AEM's Content Repository Development Environment

Medium · published September 10, 2020

CVSS v3.1
6.8
EPSS
2%
Percentile
77.8
In the wild
Unconfirmed
What it is

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when browsing to the page containing the vulnerable field.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01758 · 77.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-09-10T16:35Z
EPSS history
Timeline
  • 10 SEP 16:35Z
    Stored XSS in AEM's Content Repository Development Environment
    cvelistv5