Skip to content
OpenAdvisories
Critical · 9.8 CVE-2021-40722 EUVD-2021-27887GHSA-7h8f-9m99-6cfg

AEM Forms Improper Restriction of XML External Entity Reference

Published Jan 13, 2022 · Updated Sep 16, 2024 · Assigned by adobe

Description

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Affected products

VendorProductAffectedFixed
Adobe Experience Manager unspecified – ≤ 6.5.10.0, unspecified – ≤ None —

References