CVE-2022-35697: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

August 11, 2022

Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. Exploitation of this issue requires a low author privilege access.

References

github.com/adobe/aem-core-wcm-components/security/advisories/GHSA-qcgc-6q86-7x2p
github.com/advisories/GHSA-qcgc-6q86-7x2p
nvd.nist.gov/vuln/detail/CVE-2022-35697

Detect and mitigate CVE-2022-35697 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →