Cross-site Scripting (XSS)

2022-08-1203:14:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

adaptiveimageservlet.java

svg image

EPSS

0.001

Percentile

25.3%

JSON

core.wcm.components.core is vulnerable to cross-site scripting. The vulnerability exists because the stream function of AdaptiveImageServlet.java does not properly encode the imageName attribute, allowing an attacker to inject and execute malicious javascript through the crafted SVG image.