CVE-2022-28820

    Dashboard / Vulnerabilities / CVE-2022-28820

    CVE-2022-28820

    Published: 21 Apr 2022Last Modified: 12 Aug 2026

    Summary: Adobe Consulting Services Reflected Cross-Site Scripting Arbitrary Code Execution

    Details: ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

    References: https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-w5m2-299g-rff5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28820.json, https://nvd.nist.gov/vuln/detail/CVE-2022-28820

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c443a41f77e30b0243aadbc6634454cad317fa66

    Affected versions

    acs-aem-commons-5.1.2
    acs-aem-commons-5.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-28820 | CVE-DB