GitHub Advisoryadvisory · Maven

GHSA-7r83-w6r8-fh6w Reflected Cross-site Scripting (XSS) in ACS Commons

MEDIUM Published 2021-05-13 Modified 2021-12-13 Official page ↗
Aliases
CVE-2021-21043
Ecosystem
Maven
Packages
com.adobe.acs:acs-aem-commons
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-787, CWE-79
Reviewed
2021-04-05

Affected packages

• Maven com.adobe.acs:acs-aem-commons: < 4.10.0 → fixed in 4.10.0

Description

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

Related

Alias · CVE (1)

  • CVE-2021-21043 ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and… vulnerability

Weakness · CWE (2)

  • CWE-787 Out-of-bounds Write weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References