The version of Adobe Experience Manager installed on the remote host is prior to 6.5.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-39 advisory.

  - Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a     Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact     systems blocked by the dispatcher. Exploitation of this issue does not require user interaction.
    (CVE-2021-28627)

  - Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a     Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts     into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse     to the page containing the vulnerable field. (CVE-2021-28625, CVE-2021-28628)

  - Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an     Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated     attacker could leverage this vulnerability to cause an application denial-of-service. Exploitation of this     issue does not require user interaction. (CVE-2021-28626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Experience Manager 6.5.0.0 < 6.5.9.0 Multiple Vulnerabilities (APSB21-39)

high Nessus Plugin ID 150491

Version 1.9