Reflected Cross-site Scripting (XSS) in ACS Commons

高 8.8CVE-2021-21028 · CVE-2021-21043 · GHSA-7r83-w6r8-fh6w · 11/02/2021 公開 · 17/06/2026 更新

要点

CVE-2021-21028 は com.adobe.acs:acs-aem-commons, acrobat (adobe), acrobat dc (adobe) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：4.1%（全脆弱性の 90.8% より高い）。
対処：4.10.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.adobe.acs:acs-aem-commons Maven	`< 4.10.0`	`4.10.0`
acrobat adobe	`≥ 17.0, ≤ 17.011.30188≥ 20.0, ≤ 20.001.30018`	修正版なし
acrobat dc adobe	`≤ 20.013.20074`	修正版なし
acrobat reader adobe	`≥ 17.0, ≤ 17.011.30188≥ 20.0, ≤ 20.001.300183`	修正版なし
acrobat reader dc adobe	`≤ 20.013.20074`	修正版なし

概要

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

NVD の説明

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.