// For flags

CVE-2022-28820

Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

ACS Commons versión 5.1.x (y anteriores) sufre una vulnerabilidad de tipo Cross-site Scripting (XSS) Reflejado en el endpoint /apps/acs-commons/content/page-compare.html por medio de los parámetros GET a y b. La entrada del usuario enviada por medio de estos parámetros no es comprobada ni es saneada. Un atacante debe proporcionar un enlace a alguien con acceso a AEM Author, y podría explotar potencialmente esta vulnerabilidad para inyectar contenido JavaScript malicioso en los campos de formulario vulnerables y ejecutarlo en el contexto del navegador de la víctima. La explotación de este problema requiere la interacción del usuario para tener éxito

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-04-08 CVE Reserved
  • 2022-04-21 CVE Published
  • 2024-09-17 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
 Acs Aem Commons
Search vendor "Adobe" for product "Acs Aem Commons"
 < 5.2.0
Search vendor "Adobe" for product "Acs Aem Commons" and version " < 5.2.0"
-
Affected