Headline
CVE-2023-29322: Adobe Security Bulletin
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser.
Security updates available for Adobe Experience Manager | APSB23-31
Bulletin ID
Date Published
Priority
APSB23-31
June 13, 2023
3
Summary
Adobe has released updates for Adobe Experience Manager (AEM). These updates resolve vulnerabilities rated important and moderate. Successful exploitation of these vulnerabilities could result in arbitrary code execution and security feature bypass.
Affected product versions
Product
Version
Platform
Adobe Experience Manager (AEM)
AEM Cloud Service (CS)
All
6.5.16.0 and earlier versions
All
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
Product
Version
Platform
Priority
Availability
Adobe Experience Manager (AEM)
AEM Cloud Service Release 2023.4
All
3
Release Notes
6.5.17.0
All
3
AEM 6.5 Service Pack Release Notes
Customers running on Adobe Experience Manager’s Cloud Service will automatically receive updates that include new features as well as security and functionality bug fixes.
Vulnerability Details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-29304
URL Redirection to Untrusted Site (‘Open Redirect’) (CWE-601)
Security feature bypass
Moderate
3.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVE-2023-29307
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-29322
Cross-site Scripting (Reflected XSS) (CWE-79)
Arbitrary code execution
Important
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2023-29302
Acknowledgments
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
Jim Green (green-jam) – CVE-2023-29304, CVE-2023-29302
Osama Yousef (osamayousef) – CVE-2023-29307
Lorenzo Pirondini – CVE-2023-29322
NOTE: Adobe has a private, invite-only, bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please fill out this form for next steps.
Revisions
June 15, 2023 - Researcher “lpi” revised to "Lorenzo Pirondini".
For more information, visit https://helpx.adobe.com/security.html, or email [email protected].