PT-2021-23667 · Adobe · Experience Manager+1

Published 2021-11-16 · Updated 2023-06-26 · CVE-2021-42725

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Bridge versions prior to 11.1.1 Adobe Experience Manager versions prior to 6.5.9.0

Description The issue is related to insecure handling of malicious files and improper access control. For Adobe Bridge, it involves a memory corruption vulnerability due to the insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability. For Adobe Experience Manager, an improper access control vulnerability leads to a security feature bypass, allowing an unauthenticated attacker to gain access to arbitrary pages by manipulating referer headers.

Recommendations For Adobe Bridge version 11.1.1 and earlier, update to a version later than 11.1.1. For Adobe Experience Manager version 6.5.9.0 and earlier, update to a version later than 6.5.9.0. As a temporary workaround, consider restricting access to sensitive pages and implementing additional access controls until a patch is available.

Fix

Buffer Overflow

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-119

CWE-788

Related Identifiers

CVE-2021-42725

Affected Products

Bridge

Experience Manager

References · 6

• https://helpx.adobe.com/security/products/bridge/apsb21-94.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-42725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42725 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42725 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2021-42725 · Note
• https://t.me/cibsecurity/32475 · Telegram Post