CVE-2024-26055

2024-06-1308:15:51

CWE-79

[email protected]

web.nvd.nist.gov

adobe experience manager

6.5.20

dom-based xss

vulnerability

attacker

javascript

exploitation

user interaction

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.5%

JSON

Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the malicious script.

Affected configurations

Vulners

NVD

Node

adobeexperience_managerRange≤6.5.20

CPENameOperatorVersion
adobe:experience_manageradobe experience managerlt6.5.21
adobe:experience_manageradobe experience managerlt2024.5

CPE	Name	Operator	Version
adobe:experience_manager	adobe experience manager	lt	6.5.21
adobe:experience_manager	adobe experience manager	lt	2024.5

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Experience Manager",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "6.5.20",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]