PT-2023-1984 · Adobe · Experience Manager

Published 2023-03-14 · Updated 2023-03-31 · CVE-2023-22258

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.15.0 and earlier

Description The issue is related to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. The vulnerability allows a remote attacker to bypass security restrictions.

Recommendations For versions 6.5.15.0 and earlier, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of redirection to malicious sites. Avoid using links from untrusted sources within the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-01607

CVE-2023-22258

Affected Products

Experience Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-22258 · Security Note
• https://bdu.fstec.ru/vul/2023-01607 · Security Note
• https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22258 · Vendor Advisory
• https://t.me/cvenotify/46645 · Telegram Post
• https://vuldb.com/ru/?id.223599 · Note
• https://t.me/cvenotify/46655 · Telegram Post
• https://t.me/cvenotify/47289 · Telegram Post
• https://t.me/cibsecurity/60503 · Telegram Post