PT-2022-4095 · Adobe · Adobe Experience Manager Core Components

Vladbailescu · Published 2022-08-09 · Updated 2022-08-15 · CVE-2022-35697

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Core Components versions 2.20.6 and earlier

Description The issue is related to a reflected Cross-Site Scripting (XSS) vulnerability, which may allow an attacker to execute malicious JavaScript content within the context of a victim's browser. This can happen if the attacker convinces the victim to visit a URL referencing a vulnerable page. Exploitation of this issue requires low author privilege access. The vulnerability is also related to insufficient protection of the web page structure, which may allow a remote attacker to execute arbitrary code.

Recommendations For versions 2.20.6 and earlier, update to version 2.20.8 to resolve the issue. As a temporary workaround, consider restricting access to the AdaptiveImageServlet to minimize the risk of exploitation. Avoid allowing authors to upload specially crafted SVG images that include malicious JavaScript until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04929

CVE-2022-35697

GHSA-QCGC-6Q86-7X2P

Affected Products

Adobe Experience Manager Core Components

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-35697 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcgc-6q86-7x2p · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04929 · Security Note
• https://github.com/adobe/aem-core-wcm-components · Note
• https://github.com/adobe/aem-core-wcm-components/security/advisories/GHSA-qcgc-6q86-7x2p · Note
• https://t.me/cvenotify/34520 · Telegram Post
• https://t.me/cibsecurity/47921 · Telegram Post