What is the severity of CVE-2022-28820?

CVE-2022-28820 is considered a high severity vulnerability due to its ability to allow reflected cross-site scripting (XSS).

How do I fix CVE-2022-28820?

To mitigate CVE-2022-28820, upgrade ACS Commons to version 5.2.0 or later, which incorporates proper validation and sanitization of user input.

Who is affected by CVE-2022-28820?

CVE-2022-28820 affects users of Adobe ACS Commons version 5.1.x and earlier.

What does the CVE-2022-28820 vulnerability exploit?

CVE-2022-28820 exploits the /apps/acs-commons/content/page-compare.html endpoint through unvalidated user input in the a and b GET parameters.

Is CVE-2022-28820 an easy vulnerability to exploit?

Yes, CVE-2022-28820 can be easily exploited by attackers who can craft a malicious request to the vulnerable endpoint.

Vulnerability/
CVE-2022-28820

medium

6.1

CWE

21/4/2022

17/9/2024

CVE-2022-28820: Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

First published: Thu Apr 21 2022(Updated: )

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

Credit: psirt@adobe.com

Affected Software	Affected Version	How to fix
Adobe Consulting Services Commons	<5.2.0

Never miss a vulnerability like this again

Reference Links

https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-w5m2-299g-rff5

Frequently Asked Questions

What is the severity of CVE-2022-28820?
CVE-2022-28820 is considered a high severity vulnerability due to its ability to allow reflected cross-site scripting (XSS).
How do I fix CVE-2022-28820?
To mitigate CVE-2022-28820, upgrade ACS Commons to version 5.2.0 or later, which incorporates proper validation and sanitization of user input.
Who is affected by CVE-2022-28820?
CVE-2022-28820 affects users of Adobe ACS Commons version 5.1.x and earlier.
What does the CVE-2022-28820 vulnerability exploit?
CVE-2022-28820 exploits the /apps/acs-commons/content/page-compare.html endpoint through unvalidated user input in the a and b GET parameters.
Is CVE-2022-28820 an easy vulnerability to exploit?
Yes, CVE-2022-28820 can be easily exploited by attackers who can craft a malicious request to the vulnerable endpoint.

agent/type
agent/softwarecombine
agent/title
agent/weakness
agent/author
agent/severity
agent/references
agent/description
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/adobe
canonical/adobe consulting services commons

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.