CVE-2022-28820: Page Compare Reflected Cross-site Scripting (XSS) vulnerability in com.adobe.acs:acs-aem-commons
Summary
CVE-2022-28820: Page Compare Reflected Cross-site Scripting (XSS) vulnerability. Affects com.adobe.acs:acs-aem-commons versions < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.adobe.acs:acs-aem-commons is an open-source package that provides various utilities and enhancements for Adobe Experience Manager (AEM). It is widely used by developers to extend the functionality of AEM. However, versions 5.1.x and earlier of ACS Commons are vulnerable to a Reflected Cross-site Scripting (XSS) vulnerability in the page-compare.html endpoint. This vulnerability allows an attacker to inject malicious JavaScript code into vulnerable form fields and execute it within the victim's browser.
Vulnerability Detail
The Reflected Cross-site Scripting (XSS) vulnerability in ACS Commons arises due to the lack of validation or sanitization of user input submitted via the 'a' and 'b' GET parameters in the page-compare.html endpoint. An attacker can exploit this vulnerability by providing a link to someone with access to AEM Author. The victim needs to interact with the malicious link for the attack to be successful. Once exploited, the attacker can execute arbitrary JavaScript code within the context of the victim's browser, potentially leading to unauthorized actions or data theft.
How To Fix
Minimum fixed version
5.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is crucial to update to the patched version of ACS Commons to eliminate the risk of exploitation.
Conclusion
The Page Compare Reflected Cross-site Scripting (XSS) vulnerability in com.adobe.acs:acs-aem-commons poses a moderate risk to applications using vulnerable versions of the package. It is crucial to update to version 5.2.0 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.adobe.acs:acs-aem-commons →
FAQ
The vulnerability allows an attacker to inject and execute malicious JavaScript code within the victim's browser, potentially leading to unauthorized actions or data theft.
Yes, the victim needs to interact with a malicious link provided by the attacker for the vulnerability to be successfully exploited.
Versions 5.1.x and earlier of ACS Commons are affected.
Yes, this vulnerability has been resolved in version 5.2.0 of ACS Commons.
This vulnerability was discovered and reported by Black Lantern Security.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.adobe.acs:acs-aem-commons.
