Detections
Analytics
Adobe Experience Manager 6.1.x < 6.4.8.1 / 6.5.x < 6.5.5.0 (APSB20-31)
high Nessus Plugin ID 137367
Language:
Synopsis
The Adobe Experience Manager installed on the remote host is affected by multiple vulnerabilities (APSB20-31)Description
The version of Adobe Experience Manager installed on the remote host is 6.1.x, 6.2.x, 6.3.x, 6.4.x prior to 6.4.8.1, or 6.5.x prior to 6.5.5.0. It is, therefore, affected by multiple vulnerabilities:- An unspecified server-side request forgery (SSRF) that could result in sensitive information disclosure (CVE-2020-9643)
- An unspecified cross-site scripting vulnerability that could result in arbitrary javaScript execution (CVE-2020-9644, CVE-2020-9647, CVE-2020-9648, CVE-2020-9651)
- An unspecified blind server-side request forgery that could result sensitive information disclosure (CVE-2020-9645)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. To retrieve patch level information, this plugin requires the HTTP credentials of the web console. For accurate results, you may need to enable the Adobe Experience Manager ports (by default, 4502 and/or 4503) in your Nessus scan.
Solution
Apply the recommended update from the vendor advisory.See Also
Plugin Details
Severity: High
ID: 137367
File Name: adobe_experience_manager_apsb20-31.nasl
Version: 1.6
Type: remote
Family: Misc.
Published: 6/12/2020
Updated: 3/7/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2020-9645
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:adobe:experience_manager
Required KB Items: installed_sw/Adobe Experience Manager
Exploit Ease: No known exploits are available
Patch Publication Date: 6/9/2020
Vulnerability Publication Date: 6/9/2020
Reference Information
CVE: CVE-2020-9643, CVE-2020-9644, CVE-2020-9645, CVE-2020-9647, CVE-2020-9648, CVE-2020-9651
IAVA: 2020-A-0253-S