CVE-2022-44488
AEM URL Redirection to Untrusted Site Security feature bypass
Severity Score
5.4
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Adobe Experience Manager versión 6.5.14 (y anteriores) se ve afectado por una vulnerabilidad de redireccionamiento de URL a un sitio que no es de confianza ("Open Redirect"). Un atacante autenticado con pocos privilegios podría aprovechar esta vulnerabilidad para redirigir a los usuarios a sitios web maliciosos. La explotación de este problema requiere la interacción del usuario.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-10-31 CVE Reserved
- 2022-12-19 CVE Published
- 2024-07-11 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://helpx.adobe.com/security/products/experience-manager/apsb22-59.html | 2022-12-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Adobe Search vendor "Adobe" | Experience Manager Search vendor "Adobe" for product "Experience Manager" | < 6.5.15.0 Search vendor "Adobe" for product "Experience Manager" and version " < 6.5.15.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Experience Manager Cloud Service Search vendor "Adobe" for product "Experience Manager Cloud Service" | < 2022.10.0 Search vendor "Adobe" for product "Experience Manager Cloud Service" and version " < 2022.10.0" | - |
Affected
| ||||||