Cross site scripting

2020-09-1017:15:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.3%

JSON

The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with ‘Author’ privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

CPENameOperatorVersion
experience_managerge6.5.0.0
experience_managerle6.5.5.0
experience_managerge6.4.0.0
experience_managerle6.4.8.1
experience_managerge6.3.0.0
experience_managerle6.3.3.8
experience_managerle6.2.1.20
experience_manager_formseq6.5.5.0
experience_manager_formseq6.4.8.1

Name	Operator	Version
experience_manager	ge	6.5.0.0
experience_manager	le	6.5.5.0
experience_manager	ge	6.4.0.0
experience_manager	le	6.4.8.1
experience_manager	ge	6.3.0.0
experience_manager	le	6.3.3.8
experience_manager	le	6.2.1.20
experience_manager_forms	eq	6.5.5.0
experience_manager_forms	eq	6.4.8.1