CVE-2020-9733

Published: Sep 10, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.

Affected (6)

Products: Adobe: Experience Manager, Experience Manager Forms

Adobe

2 products

Experience Manager

Experience Manager Forms

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Adobe Experience Manager	Up to 6.2.1.20
Adobe Experience Manager	From 6.3.0.0 to 6.3.3.8
Adobe Experience Manager	From 6.4.0.0 to 6.4.8.1
Adobe Experience Manager	From 6.5.0.0 to 6.5.5.0
Adobe Experience Manager Forms	Version 6.4.8.1
Adobe Experience Manager Forms	Version 6.5.5.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Source: psirt@adobe.com

PatchVendor Advisory

https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.