CVE-2020-9742: Reflected XSS in AEM Inbox module
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9742?
CVE-2020-9742 is considered a medium severity vulnerability due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2020-9742?
To mitigate CVE-2020-9742, users should upgrade to Adobe Experience Manager version 6.5.5.1 or later, 6.4.8.2 or later, or 6.3.3.9 or later.
What are the affected versions of Adobe Experience Manager for CVE-2020-9742?
CVE-2020-9742 affects Adobe Experience Manager versions 6.3.3.8 and earlier, 6.4.8.1 and earlier, and 6.5.5.0 and earlier.
Who is impacted by CVE-2020-9742?
Users with 'Author' privileges in Adobe Experience Manager are impacted by CVE-2020-9742 as they can store vulnerable scripts.
What kind of vulnerability is CVE-2020-9742?
CVE-2020-9742 is a stored cross-site scripting (XSS) vulnerability that allows the execution of malicious scripts.