CVE-2024-52837

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input for the exploit to execute.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:experience_manager:::::-:::*
	cpe:2.3:a:adobe:experience_manager:::::aem_cloud_service:::*

History

No history.

Information

Published : 2024-12-10 22:15

Updated : 2024-12-18 14:34

NVD link : CVE-2024-52837

Mitre link : CVE-2024-52837

CVE.ORG link : CVE-2024-52837

JSON object : View

Products Affected

adobe

experience_manager

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-52837", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-12-10T22:15:18.850", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb24-69.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access the manipulated URL or input for the exploit to execute."}, {"lang": "es", "value": "Las versiones 6.5.21 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de DOM-based Cross-Site Scripting (XSS) en DOM que un atacante podr\u00eda aprovechar para ejecutar c\u00f3digo arbitrario en el contexto de la sesi\u00f3n del navegador de la v\u00edctima. Al manipular un elemento DOM a trav\u00e9s de una URL manipulada o de la entrada del usuario, el atacante puede inyectar secuencias de comandos maliciosas que se ejecutan cuando se procesa la p\u00e1gina. Este tipo de ataque requiere la interacci\u00f3n del usuario, ya que la v\u00edctima tendr\u00eda que visitar un enlace malicioso o ingresar datos en un formulario comprometido."}], "lastModified": "2024-12-18T14:34:46.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "4A30C141-E776-4D0C-8F40-17C9560BF2A3", "versionEndExcluding": "6.5.22.0"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*", "vulnerable": true, "matchCriteriaId": "32D69634-ED91-469C-B4C8-FE1E942DCCE4", "versionEndExcluding": "2024.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}