PT-2023-1940 · Adobe · Experience Manager

Publicado 2023-03-14 · Atualizado 2023-03-24 · CVE-2023-22271

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.15.0 and earlier

Description The issue is related to the use of a weak encryption mechanism in Adobe Experience Manager, which can be exploited by a remote attacker to disclose protected information. A low-privileged attacker can exploit this vulnerability to decrypt a user's password, but the attack complexity is high because it requires the attacker to already possess the encrypted secret.

Recommendations For Adobe Experience Manager versions 6.5.15.0 and earlier, consider disabling the password decryption functionality until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-261

Identificadores relacionados

BDU:2023-01550

CVE-2023-22271

Produtos afetados

Experience Manager

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-22271 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01550 · Nota de Segurança
• https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html · Aviso do Fabricante
• https://t.me/cvenotify/46638 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22271 · Nota de Segurança