CVE-2021-40722

Published: Jan 13, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Affected (2)

Products: Adobe: Experience Manager, Experience Manager Cloud Service

Adobe

2 products

Experience Manager

Experience Manager Cloud Service

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Adobe Experience Manager	Up to 6.5.10.0
Adobe Experience Manager Cloud Service	All versions

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html

Source: psirt@adobe.com

Release NotesVendor Advisory

https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.