CVE-2024-49524

{"id": "CVE-2024-49524", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-11-07T22:15:21.200", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb24-28.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated URL or provide specific input to trigger the vulnerability."}, {"lang": "es", "value": "Las versiones 6.5.20 y anteriores de Adobe Experience Manager se ven afectadas por una vulnerabilidad de Cross-Site Scripting (XSS) basada en DOM que un atacante podr\u00eda aprovechar para ejecutar c\u00f3digo arbitrario en el contexto de la sesi\u00f3n del navegador de la v\u00edctima. Al manipular un elemento DOM a trav\u00e9s de una URL manipulada o una entrada del usuario, el atacante puede inyectar secuencias de comandos maliciosas que se ejecutan cuando se procesa la p\u00e1gina. Este tipo de ataque requiere la interacci\u00f3n del usuario, ya que la v\u00edctima tendr\u00eda que acceder a una URL manipulada o proporcionar una entrada espec\u00edfica para activar la vulnerabilidad."}], "lastModified": "2024-12-02T22:44:21.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "AAF67BB0-572D-4DCA-9CEB-C30D5D8FDB48", "versionEndExcluding": "6.5.21.0"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*", "vulnerable": true, "matchCriteriaId": "5FF97DFB-A8E0-4311-A6EA-303A4D8612C2", "versionEndExcluding": "2024.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}