CVE-2020-9743CWE-20

HTML injection in AEM's content editor component

Medium · published September 10, 2020

CVSS v3.1
5.3
EPSS
2%
Percentile
80.1
In the wild
Unconfirmed
What it is

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01955 · 80.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2020-09-10T16:36Z
EPSS history
Timeline
  • 10 SEP 16:36Z
    HTML injection in AEM's content editor component
    cvelistv5