CVE-2020-9740
Status: ModifiedMedium (5.4)—
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Base score: 5.4
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.88%
- Percentile among all scored CVEs: 79
- Score date: 10/9/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
- CWE-79
References
Raw JSON (NVD)
Show
{
"id": "CVE-2020-9740",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.3
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.4,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.3
}
]
},
"affected": [
{
"source": "psirt@adobe.com",
"affectedData": [
{
"vendor": "Adobe",
"product": "Experience Manager",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.5.5.0"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.4.8.1"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.3.3.8"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.2 SP1-CFP20"
}
]
}
]
}
],
"published": "2020-09-10T17:15:41.110",
"references": [
{
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html",
"tags": [
"Vendor Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Design Importer. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field."
},
{
"lang": "es",
"value": "Las versiones de AEM 6.5.5.0 (y anteriores), 6.4.8.1 (y anteriores), 6.3.3.8 (y anteriores) y 6.2 SP1-CFP20 (y posteriores) están afectadas por una vulnerabilidad de tipo XSS almacenado que permite a usuarios con privilegios de \"Author\" almacenar scripts maliciosos en campos asociados con Design Importer. Estos scripts pueden ser ejecutados en el navegador de la víctima cuando abre la página que contiene el campo vulnerable"
}
],
"lastModified": "2026-06-17T03:28:29.780",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F61E8D62-4FB7-48E0-A750-C3F6EBE5F613",
"versionEndIncluding": "6.3.3.8",
"versionStartIncluding": "6.3.0.0"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0482E99D-21DC-489C-8E0B-707A70A48FC0",
"versionEndIncluding": "6.4.8.1",
"versionStartIncluding": "6.4.0.0"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9D06479-83AE-4F9A-BAE9-7849798F1A30",
"versionEndIncluding": "6.5.5.0",
"versionStartIncluding": "6.5.0.0"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE7DD1A2-EB34-4862-878F-0768D91ED375"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3E28FB2-DD09-471E-A846-45D00A1DEAE7"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1537FAD0-6B8C-440E-ADBE-6E55B5E95545"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80CD82AA-BD51-44ED-843D-155E0253A9EE"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp12.1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F50647B-FD1C-43E4-A688-F9B4ED244028"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A97165F4-F357-4271-A141-4091973F9A34"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92D76A04-0B29-4BF2-B016-7FA82B12FE53"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C555A79-F619-4119-9DEA-0679059F6111"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9732E3D9-15A3-4571-8B40-88B7FF64D994"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2DB2AFF-4C6D-4CFD-8BCD-6ED5FABF677C"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7D72D08D-3B08-4FA9-A5D8-1709229CCAA9"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CEA0E51-6982-4F18-A7BC-500C341E415E"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A531C028-FED4-473E-BB08-E4D92C3AE5F0"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "880D18CA-1FF0-436D-91C0-E29C85C4AD8C"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8871723-95D7-4A4A-A232-A7CE7F5EE020"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8C22A756-74DB-4D4F-9B32-00D85F127260"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EBDA638-4C8A-438F-96E2-B5EAA2B21DCF"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A457620-A285-4F7F-8FA7-3F0C514E4658"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BA4E1EE-C90A-4028-8DBC-47F6DF90021E"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD076F63-6F46-4852-9080-1AD72B5001F9"
},
{
"criteria": "cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D75869C-D57A-480B-941A-8679EABAE593"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@adobe.com"
}