title: Stored XSS using Workflow field at `https://author-bugbounty-65-prod.adobecqms.net/etc/workflow/wcm/templates.html`
description: Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
problem types: Cross-site Scripting (Stored XSS) (CWE-79)
affected:
{
defaultStatus: affected
product: Adobe Experience Manager
vendor: Adobe
versions:
lessThanOrEqual: 6.5.19, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 3.4
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 3.4
environmentalSeverity: LOW
exploitCodeMaturity: NOT_DEFINED
integrityImpact: NONE
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: HIGH
modifiedScope: NOT_DEFINED
modifiedUserInteraction: REQUIRED
privilegesRequired: HIGH
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 3.4
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL