GitHub Advisoryadvisory · Maven

GHSA-qcgc-6q86-7x2p AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

MEDIUM Published 2022-08-11 Modified 2022-08-11 Official page ↗
Aliases
CVE-2022-35697
Ecosystem
Maven
Packages
com.adobe.cq:core.wcm.components.core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-08-11

Affected packages

• Maven com.adobe.cq:core.wcm.components.core: < 2.20.8 → fixed in 2.20.8

Description

Core Components version 2.20.6 (and earlier) suffer from a reflected cross-site scripting (XSS) vulnerability in `AdaptiveImageServlet` via SVG images. An attacker with author access can upload a special crafted SVG image (including a malicious Javascript) and obtain a link that, when loaded by another authenticated users, will execute the malicious script and gain access to other user's session. The issue has been resolved in 2.20.8. There are currently no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-35697 Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References