The version of Adobe Experience Manager installed on the remote host is prior to 6.5.14.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-40 advisory.

  - Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting     (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable     page, malicious JavaScript content may be executed within the context of the victim's browser.
    Exploitation of this issue requires low-privilege access to AEM. (CVE-2022-28851, CVE-2022-30677,     CVE-2022-30678, CVE-2022-30680, CVE-2022-30681, CVE-2022-30682, CVE-2022-30684, CVE-2022-30685,     CVE-2022-30686, CVE-2022-34218, CVE-2022-35664, CVE-2022-38438, CVE-2022-38439)

  - Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a Violation of Secure Design     Principles vulnerability that could lead to bypass the security feature of the encryption mechanism in the     backend . An attacker could leverage this vulnerability to decrypt secrets, however, this is a high-     complexity attack as the threat actor needs to already possess those secrets. Exploitation of this issue     requires low-privilege access to AEM. (CVE-2022-30683)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Experience Manager 6.5.0.0 < 6.5.14.0 Multiple Vulnerabilities (APSB22-40)

medium Nessus Plugin ID 164989

Version 1.8