Headline
CVE-2023-22271: Adobe Security Bulletin
Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in order to decrypt a user’s password. The attack complexity is high since a successful exploitation requires to already have in possession this encrypted secret.
Security updates available for Adobe Experience Manager | APSB23-18
Bulletin ID
Date Published
Priority
APSB23-18
March 14, 2023
3
Summary
Adobe has released updates for Adobe Experience Manager (AEM). These updates resolve vulnerabilities rated important and moderate. Successful exploitation of these vulnerabilities could result in arbitrary code execution, privilege escalation and security feature bypass.
Affected product versions
Product
Version
Platform
Adobe Experience Manager (AEM)
AEM Cloud Service (CS)
All
6.5.15.0 and earlier versions
All
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
Product
Version
Platform
Priority
Availability
Adobe Experience Manager (AEM)
AEM Cloud Service Release 2023.1
All
3
Release Notes
6.5.16.0
All
3
AEM 6.5 Service Pack Release Notes
Customers running on Adobe Experience Manager’s Cloud Service will automatically receive updates that include new features as well as security and functionality bug fixes.
Vulnerability details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-22252
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-22253
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-22254
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22256
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22257
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22258
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22259
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22260
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22261
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22262
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22263
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22264
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22265
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVE-2023-22266
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-22269
Weak Cryptography for Passwords (CWE-261)
Privilege escalation
Important
5.3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2023-22271
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-21615
Cross-site Scripting (Stored XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-21616
Acknowledgments
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
- Jim Green (green-jam) – CVE-2023-22252, CVE-2023-22253, CVE-2023-22254, CVE-2023-22256, CVE-2023-22257, CVE-2023-22258, CVE-2023-22259, CVE-2023-22260, CVE-2023-22261, CVE-2023-22262, CVE-2023-22263, CVE-2023-22264, CVE-2023-22265, CVE-2023-22266, CVE-2023-22269, CVE-2023-22271, CVE-2023-21615, CVE-2023-21616
For more information, visit https://helpx.adobe.com/security.html, or email [email protected].