CVE-2024-43738

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the execution of unintended script code or the alteration of the intended user interface. User interaction is required as the victim must visit a malicious page or view a maliciously crafted link.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:experience_manager:::::-:::*
	cpe:2.3:a:adobe:experience_manager:::::aem_cloud_service:::*

History

17 Dec 2024, 15:11

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-10 22:15

Updated : 2024-12-17 15:11

NVD link : CVE-2024-43738

Mitre link : CVE-2024-43738

CVE.ORG link : CVE-2024-43738

JSON object : View

Products Affected

adobe

experience_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-43738", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-12-10T22:15:10.153", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the execution of unintended script code or the alteration of the intended user interface. User interaction is required as the victim must visit a malicious page or view a maliciously crafted link."}, {"lang": "es", "value": "Las versiones 6.5.21 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de DOM-based Cross-Site Scripting (XSS) en DOM que podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario en el contexto del navegador de la v\u00edctima. Este problema se produce cuando una aplicaci\u00f3n web procesa datos de una fuente maliciosa y, posteriormente, los escribe en la p\u00e1gina web sin la limpieza adecuada, lo que permite la ejecuci\u00f3n de c\u00f3digo de secuencia de comandos no deseado o la alteraci\u00f3n de la interfaz de usuario prevista. La interacci\u00f3n del usuario es necesaria ya que la v\u00edctima debe visitar una p\u00e1gina maliciosa o ver un enlace creado con fines malintencionados."}], "lastModified": "2024-12-17T15:11:07.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "4A30C141-E776-4D0C-8F40-17C9560BF2A3", "versionEndExcluding": "6.5.22.0"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*", "vulnerable": true, "matchCriteriaId": "32D69634-ED91-469C-B4C8-FE1E942DCCE4", "versionEndExcluding": "2024.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}