PT-2020-5405 · Adobe · Aem Forms+1
Published
2020-12-08
·
Updated
2020-12-14
·
CVE-2020-24444
CVSS v3.1
5.8
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
AEM Forms SP6 add-on for AEM 6.5.6.0
AEM Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2)
Description
The issue is a blind Server-Side Request Forgery (SSRF) vulnerability. This could be exploited by an unauthenticated attacker to gather information about internal systems that reside on the same network. The vulnerability may allow a remote attacker to gain unauthorized access to protected information using the HTTP protocol.
Recommendations
For AEM Forms SP6 add-on for AEM 6.5.6.0, update to a version that includes the fix for this issue.
For AEM Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2), update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to internal systems to minimize the risk of exploitation.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Aem
Aem Forms