« Volver al listado

CVE-2025-54249

Estado: AnalizadaMedia (6.5)—

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Adobe — Experience Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-54249",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54249",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-09T17:09:09.322837Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Adobe Experience Manager",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "6.5.23.0"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-09-09T17:15:58.663",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access."
    },
    {
      "lang": "es",
      "value": "Versiones 6.5.23.0 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) que podría resultar en una omisión de característica de seguridad. Un atacante con pocos privilegios podría aprovechar esta vulnerabilidad para manipular peticiones del lado del servidor y omitir controles de seguridad, permitiendo acceso de lectura no autorizado."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FFEE087-8858-44D0-8D12-9196F0E33ADA",
              "versionEndIncluding": "6.5.23.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A9F7972-FCFA-43C8-A3CD-5895096B4767",
              "versionEndIncluding": "2025.8.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F"
            },
            {
              "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00DDCBAD-1FEF-487F-97BB-481DC02F493A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}