CVE-2022-28820: 
Java vulnerability analysis and mitigation

ACS Commons version 5.1.x and earlier contains a Reflected Cross-site Scripting (XSS) vulnerability (CVE-2022-28820) discovered in April 2022. The vulnerability exists in the /apps/acs-commons/content/page-compare.html endpoint through the 'a' and 'b' GET parameters, where user input is not properly validated or sanitized (GitHub Advisory).

The vulnerability is classified as a Reflected Cross-site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The vulnerability stems from improper neutralization of input during web page generation (CWE-79) in the page comparison functionality (NVD).

If successfully exploited, an attacker could potentially inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The attack requires user interaction and access to AEM Author to be successful (GitHub Advisory).

The vulnerability has been patched in version 5.2.0 of ACS Commons. No workarounds are available for earlier versions, making upgrading to version 5.2.0 or later the only solution (GitHub Advisory).

The vulnerability was discovered and reported by Black Lantern Security through the HackerOne platform (Report #1466020) (GitHub Advisory).