Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveAdobeCVE-2020-9735
HistorySep 10, 2020 - 5:15 p.m.

CVE-2020-9735

2020-09-1017:15:40
CWE-79
adobe
web.nvd.nist.gov
20
aem
xss
vulnerability
security
stored
cve-2020-9735
nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when search queries return the page containing the vulnerable field.

Affected configurations

Nvd
Vulners
Node
adobeexperience_managerRange6.3.0.0–6.3.3.8
OR
adobeexperience_managerRange6.4.0.0–6.4.8.1
OR
adobeexperience_managerRange6.5.0.0–6.5.5.0
OR
adobeexperience_managerMatch6.2.0.0sp1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp10
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp11
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp12.1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp13
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp14
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp15
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp16
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp17
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp18
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp19
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp2
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp20
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp3
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp4
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp5
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp6
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp7
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp8
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp9
VendorProductVersionCPE
adobeexperience_manager*cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp10:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp11:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp12.1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp13:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp14:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp15:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp16:*:*:*:*:*:*
Rows per page:
1-10 of 221

CNA Affected

[
  {
    "product": "Experience Manager",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "6.5.5.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.4.8.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.3.3.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.2 SP1-CFP20",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Related

cvelist 1
prion 1
nvd 1
nessus 1
adobe 1
threatpost 1
cvelist
cvelist
CVE-2020-9735 Stored XSS in AEM's Content Repository Development Environment
2020-09-10 16:35:16
prion
prion
Cross site scripting
2020-09-10 17:15:00
nvd
nvd
CVE-2020-9735
2020-09-10 17:15:40
nessus
nessus
Adobe Experience Manager 6.2.x <= 6.2 SP1-CFP20 / 6.3.x <= 6.3.3.8 / 6.4.x < 6.4.8.2 / 6.5.x < 6.5.6.0 (APSB20-56)
2020-09-11 00:00:00
adobe
adobe
APSB20-56 Security update available for Adobe Experience Manager
2020-09-08 00:00:00
threatpost
threatpost
Critical Adobe Flaws Allow Attackers to Run JavaScript in Browsers
2020-09-08 16:52:23

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

4.2

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON
Related for CVE-2020-9735
cvelist1prion1nvd1nessus1adobe1threatpost1