Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveAdobeCVE-2020-9740
HistorySep 10, 2020 - 5:15 p.m.

CVE-2020-9740

2020-09-1017:15:41
CWE-79
adobe
web.nvd.nist.gov
26
cve-2020-9740
aem
xss
security vulnerability
nvd
adobe experience manager
author privileges

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with ‘Author’ privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

Affected configurations

Nvd
Vulners
Node
adobeexperience_managerRange6.3.0.0–6.3.3.8
OR
adobeexperience_managerRange6.4.0.0–6.4.8.1
OR
adobeexperience_managerRange6.5.0.0–6.5.5.0
OR
adobeexperience_managerMatch6.2.0.0sp1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp10
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp11
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp12.1
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp13
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp14
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp15
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp16
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp17
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp18
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp19
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp2
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp20
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp3
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp4
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp5
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp6
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp7
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp8
OR
adobeexperience_managerMatch6.2.0.0sp1-cfp9
VendorProductVersionCPE
adobeexperience_manager*cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp10:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp11:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp12.1:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp13:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp14:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp15:*:*:*:*:*:*
adobeexperience_manager6.2.0.0cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp16:*:*:*:*:*:*
Rows per page:
1-10 of 221

CNA Affected

[
  {
    "product": "Experience Manager",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "6.5.5.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.4.8.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.3.3.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "6.2 SP1-CFP20",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Related

nvd 1
prion 1
cvelist 1
nessus 1
adobe 1
threatpost 1
nvd
nvd
CVE-2020-9740
2020-09-10 17:15:41
prion
prion
Cross site scripting
2020-09-10 17:15:00
cvelist
cvelist
CVE-2020-9740 Stored XSS in AEM Design Importer Component
2020-09-10 16:34:33
nessus
nessus
Adobe Experience Manager 6.2.x <= 6.2 SP1-CFP20 / 6.3.x <= 6.3.3.8 / 6.4.x < 6.4.8.2 / 6.5.x < 6.5.6.0 (APSB20-56)
2020-09-11 00:00:00
adobe
adobe
APSB20-56 Security update available for Adobe Experience Manager
2020-09-08 00:00:00
threatpost
threatpost
Critical Adobe Flaws Allow Attackers to Run JavaScript in Browsers
2020-09-08 16:52:23

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

4.6

Confidence

High

EPSS

0.001

Percentile

25.3%

JSON
Related for CVE-2020-9740
nvd1prion1cvelist1nessus1adobe1threatpost1