CVE-2021-40722
Assigner: adobe
Published: 2021-12-14T00:00:00
State: PUBLISHED
affected: product: Experience Manager
vendor: Adobe
versions: lessThanOrEqual: 6.5.10.0
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: None
status: affected
version: unspecified
versionType: custom
datePublic: 2021-12-14T00:00:00
descriptions: value: AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-611
description: Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
type: CWE
source: discovery: EXTERNAL
title: AEM Forms Improper Restriction of XML External Entity Reference