Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. The scope of the vulnerability is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2025-54248 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can send specially crafted requests to the affected Adobe Experience Manager instances. By manipulating input parameters, the attacker can bypass security controls and gain unauthorized access to sensitive information. This can be done without requiring user interaction, making it easier for attackers to exploit the vulnerability remotely.
Affected Products
- Adobe Experience Manager 6.5.23.0 and earlier: Vulnerable to improper input validation leading to security feature bypass.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager that addresses the improper input validation issue. Additionally, implementing strict input validation and monitoring for unusual access patterns can help reduce the risk of exploitation.