CVE-2020-9743: HTML injection in AEM's content editor component
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9743?
CVE-2020-9743 is classified as a critical vulnerability due to its potential for HTML injection by unauthenticated users.
How do I fix CVE-2020-9743?
To fix CVE-2020-9743, upgrade to Adobe Experience Manager version 6.5.5.1 or later, 6.4.8.2 or later, 6.3.3.9 or later, or 6.2 SP1-CFP21 or later.
Which versions of Adobe Experience Manager are affected by CVE-2020-9743?
CVE-2020-9743 affects Adobe Experience Manager versions 6.5.5.0 and below, 6.4.8.1 and below, 6.3.3.8 and below, and 6.2 SP1-CFP20 and below.
What type of vulnerability is CVE-2020-9743?
CVE-2020-9743 is an HTML injection vulnerability, allowing attackers to inject arbitrary HTML code.
Can CVE-2020-9743 be exploited remotely?
Yes, CVE-2020-9743 can be exploited by unauthenticated users remotely through crafted HTTP requests.