AEM Forms Improper Restriction of XML External Entity Reference (Adobe Experience Manager)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.27 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
Weaknesses (CWE)
- CWE-611 — Improper Restriction of XML External Entity Reference
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | adobe |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-27887
- GCVE · GCVE-0-2021-40722
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*≤ 6.5.10.0cpe:2.3:a:adobe:experience_manager_cloud_service:-:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Experience Manager | affected unspecified ≤ 6.5.10.0 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |