Vulnerability Details CVE-2020-9740
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.1%
CVSS Severity
CVSS v3 Score 9.0
CVSS v2 Score 3.5
References
Products affected by CVE-2020-9740
-
cpe:2.3:a:adobe:experience_manager:6.2.0.0
-
cpe:2.3:a:adobe:experience_manager:6.3.0.0
-
cpe:2.3:a:adobe:experience_manager:6.3.0.1
-
cpe:2.3:a:adobe:experience_manager:6.3.1.0
-
cpe:2.3:a:adobe:experience_manager:6.3.2.0
-
cpe:2.3:a:adobe:experience_manager:6.3.2.1
-
cpe:2.3:a:adobe:experience_manager:6.3.2.2
-
cpe:2.3:a:adobe:experience_manager:6.3.3.0
-
cpe:2.3:a:adobe:experience_manager:6.3.3.7
-
cpe:2.3:a:adobe:experience_manager:6.3.3.8
-
cpe:2.3:a:adobe:experience_manager:6.4.0.0
-
cpe:2.3:a:adobe:experience_manager:6.4.1.0
-
cpe:2.3:a:adobe:experience_manager:6.4.2.0
-
cpe:2.3:a:adobe:experience_manager:6.4.7.0
-
cpe:2.3:a:adobe:experience_manager:6.4.8.1
-
cpe:2.3:a:adobe:experience_manager:6.5.0.0
-
cpe:2.3:a:adobe:experience_manager:6.5.1.0
-
cpe:2.3:a:adobe:experience_manager:6.5.2.0
-
cpe:2.3:a:adobe:experience_manager:6.5.3.0
-
cpe:2.3:a:adobe:experience_manager:6.5.4.0
-
cpe:2.3:a:adobe:experience_manager:6.5.5.0