AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting

中 5.4CVE-2022-35697 · GHSA-qcgc-6q86-7x2p · 10/08/2022 公開 · 17/06/2026 更新

要点

CVE-2022-35697 は com.adobe.cq:core.wcm.components.core, web content management core components (adobe) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.72%（全脆弱性の 54.0% より高い）。
対処：2.20.8 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.adobe.cq:core.wcm.components.core Maven	`< 2.20.8`	`2.20.8`
web content management core components adobe	`≤ 2.20.6`	修正版なし

概要

Core Components version 2.20.6 (and earlier) suffer from a reflected cross-site scripting (XSS) vulnerability in AdaptiveImageServlet via SVG images. An attacker with author access can upload a special crafted SVG image (including a malicious Javascript) and obtain a link that, when loaded by another authenticated users, will execute the malicious script and gain access to other user's session. The issue has been resolved in 2.20.8. There are currently no known workarounds.

NVD の説明

Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires a low author privilege access.