CVE-2024-43738 — Cross-site Scripting in Adobe Experience Manager

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 42.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe Experience ManagerAdobe Experience Manager
Timeline
PublishedDec 10
Latest updateAug 19

Description

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web application and subsequently written to the web page without proper sanitization, allowing for the execution of unintended script code or the alteration of the intended user interface. User interaction is requ…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDadobe/experience_manager< 6.5.22.0+1

🔴Vulnerability Details

3
GHSA
Liferay Portal Reflected Cross-Site Scripting Vulnerability in displayType Parameter↗2025-08-19
▶
GHSA
GHSA-vgjp-cgp8-g7f8: Adobe Experience Manager versions 6↗2024-12-11
▶
CVEList
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)↗2024-12-10
▶
CVE-2024-43738 — Cross-site Scripting in Adobe | cvebase