Skip to content
OpenAdvisories
High NCSC-2025-0283 7 CVEs

Kwetsbaarheden verholpen in Adobe Experience Manager

Published Sep 10, 2025 · Updated Sep 10, 2025 · nl

Vendor: Adobe Product: Experience Manager Product: Experience Manager (AEM) Product: Experience Manager (AEM) Cloud Service

Summary

Adobe heeft kwetsbaarheden verholpen in Adobe Experience Manager (versies 6.5.23.0 en eerder).

Details

Interpretaties
De kwetsbaarheden bevinden zich in de manier waarop Adobe Experience Manager omgaat met beveiligingsmaatregelen. Aanvallers met beperkte rechten, kunnen deze kwetsbaarheden misbruiken om ongeautoriseerde lees- en schrijfrechten uit te voeren, wat kan leiden tot compromittering van de integriteit van het systeem. Dit omvat onder andere een stored XSS-kwetsbaarheid, een Server-Side Request Forgery (SSRF) en een XML-injectie.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • High 7.7
    CVE-2025-54248

    Adobe Experience Manager | Improper Input Validation (CWE-20)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain …

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54246

    Adobe Experience Manager | Incorrect Authorization (CWE-863)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain un…

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54247

    Adobe Experience Manager | Improper Input Validation (CWE-20)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain …

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54249 Scanner template

    Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side req…

    Adobe Adobe Experience Manager
  • Medium 5.4
    CVE-2025-54252

    Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing …

    Adobe Adobe Experience Manager
  • Medium 4.9
    CVE-2025-54250

    Adobe Experience Manager | Improper Input Validation (CWE-20)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain…

    Adobe Adobe Experience Manager
  • Medium 4.3
    CVE-2025-54251 Scanner template

    Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauth…

    Adobe Adobe Experience Manager

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html