Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-54249 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can craft specific requests that manipulate server-side processes. By doing so, they can bypass security measures in place, potentially gaining unauthorized access to sensitive information stored on the server.
Affected Products
- Adobe Experience Manager 6.5.23.0 and earlier: Vulnerable to SSRF allowing unauthorized read access.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest version of Adobe Experience Manager. Additionally, implementing strict access controls and monitoring server-side requests can help reduce the risk of exploitation.