title: HTML injection in AEM's content editor component
description: AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).
problem types: Improper Input Validation (CWE-20)
affected:
{
product: Experience Manager
vendor: Adobe
versions:
lessThanOrEqual: 6.5.5.0, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.4.8.1, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.3.3.8, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.2 SP1-CFP20, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]