CVE-2024-36181

2024-06-1308:16:10

CWE-79

[email protected]

web.nvd.nist.gov

adobe experience manager

cross-site scripting

user interaction

browser session

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.5%

JSON

Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, typically in the form of convincing a victim to visit a maliciously crafted web page or to interact with a maliciously modified DOM element within the application.

Affected configurations

Vulners

NVD

Node

adobeexperience_managerRange≤6.5.20

CPENameOperatorVersion
adobe:experience_manageradobe experience managerlt6.5.21
adobe:experience_manageradobe experience managerlt2024.5

CPE	Name	Operator	Version
adobe:experience_manager	adobe experience manager	lt	6.5.21
adobe:experience_manager	adobe experience manager	lt	2024.5

CNA Affected

[
  {
    "defaultStatus": "affected",
    "product": "Adobe Experience Manager",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "6.5.20",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]