Reflected Cross-site Scripting in ACS Commons
Impact
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly.
An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.
Patches
This issue has been resolved in v4.10.0
Workarounds
No workaround exist.
References
N/A
For more information
If you have any questions or comments about this advisory open an issue in acs-aem-commons.
Credit
This issue was discovered and reported by Christopher Whipp (Christopher.Whipp@servicesaustralia.gov.au).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.adobe.acs:acs-aem-commons | < 4.10.0 | 4.10.0 |
References
- https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-f92j-qf46-p6vm
- https://nvd.nist.gov/vuln/detail/CVE-2021-21043
- https://github.com/Adobe-Consulting-Services/acs-aem-commons/commit/14d769c86606c4ce9a93c47a19f87e1ad72788d6
- https://github.com/Adobe-Consulting-Services/acs-aem-commons
- https://helpx.adobe.com/security/products/indesign/apsb21-22.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-21028
- https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-787, CWE-79, CWE-416- Platform
- Java / Kotlin (Maven)
- Package
com.adobe.acs:acs-aem-commons- Disclosed
- 02.02.2021
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7r83-w6r8-fh6w - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-f92j-qf46-p6vm - CC BY 4.0
Vulnerability history: com.adobe.acs:acs-aem-commons
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 02.2021 04.2022
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2021: 1
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Reflected Cross-site Scripting in ACS Commons this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.