PT-2021-6798 · Adobe · Experience Manager

Published 2021-09-14 · Updated 2021-10-01 · CVE-2021-40713

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.9.0 and earlier

Description The issue is related to errors in the certificate authentication procedure, which can allow a remote attacker to bypass existing security restrictions. Specifically, it involves an improper certificate validation vulnerability in the cold storage component. If an attacker achieves a man-in-the-middle position when the cold server establishes a new certificate, they can harvest sensitive information.

Recommendations For Adobe Experience Manager versions 6.5.9.0 and earlier, consider disabling the cold storage component until a patch is available to prevent exploitation of the improper certificate validation vulnerability. Restrict access to sensitive information to minimize the risk of data harvesting. As a temporary workaround, avoid using the cold storage component for sensitive data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2022-02221

CVE-2021-40713

Affected Products

Experience Manager

References · 6

• https://helpx.adobe.com/security/products/experience-manager/apsb21-82.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40713 · Security Note
• https://bdu.fstec.ru/vul/2022-02221 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40713 · Vendor Advisory
• https://t.me/cvenotify/21736 · Telegram Post
• https://t.me/cibsecurity/29514 · Telegram Post