CVE-2020-9735: Stored XSS in AEM's Content Repository Development Environment
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with access to the Content Repository Development Environment to store malicious scripts in certain node fields. These scripts may be executed in a victim’s browser when search queries return the page containing the vulnerable field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9735?
CVE-2020-9735 is classified as a stored cross-site scripting (XSS) vulnerability that can have a high impact if exploited.
How do I fix CVE-2020-9735?
To fix CVE-2020-9735, upgrade Adobe Experience Manager to a version above 6.5.5.0, 6.4.8.1, 6.3.3.8, or 6.2 SP1-CFP20.
What systems are affected by CVE-2020-9735?
CVE-2020-9735 affects Adobe Experience Manager versions up to and including 6.5.5.0, 6.4.8.1, 6.3.3.8, and 6.2 SP1-CFP20.
What can an attacker do with CVE-2020-9735?
An attacker leveraging CVE-2020-9735 can store malicious scripts within the application's content repository, potentially executing those scripts in the browsers of users.
Is there a workaround for CVE-2020-9735?
Currently, the recommended approach for CVE-2020-9735 is to apply the latest patches or upgrade the affected Adobe Experience Manager versions.