The version of Adobe Experience Manager installed on the remote host is prior to 6.5.16.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB23-18 advisory.

  - Experience Manager versions 6.5.15.0 (and earlier) are affected by a reflected Cross-Site Scripting (XSS)     vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a     vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
    (CVE-2023-21615, CVE-2023-21616, CVE-2023-22252, CVE-2023-22253, CVE-2023-22254, CVE-2023-22269)

  - Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site     ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability     to redirect users to malicious websites. Exploitation of this issue requires user interaction.
    (CVE-2023-22256, CVE-2023-22257, CVE-2023-22258, CVE-2023-22259, CVE-2023-22260, CVE-2023-22261,     CVE-2023-22262, CVE-2023-22263, CVE-2023-22264, CVE-2023-22265, CVE-2023-22266)

  - Experience Manager versions 6.5.15.0 (and earlier) are affected by a Weak Cryptography for Passwords     vulnerability that can lead to a security feature bypass. A low-privileged attacker can exploit this in     order to decrypt a user's password. The attack complexity is high since a successful exploitation requires     to already have in possession this encrypted secret. (CVE-2023-22271)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Experience Manager 6.5.0.0 < 6.5.16.0 Multiple Vulnerabilities (APSB23-18)

medium Nessus Plugin ID 172583

Version 1.3

Version 1.2

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Oct 16, 2023, 7:25 PM Plugin categorization Plugin Feed: 202310161925
Version 1.2 Jun 16, 2023, 8:11 AM IAVM reference Plugin Feed: 202306160811
Version 1.2 Oct 16, 2023, 5:15 PM Plugin categorization Plugin Feed: 202310161715
Version 1.1 Mar 16, 2023, 10:11 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202303162211
Version 1.0 Mar 15, 2023, 10:01 PM New Plugin Feed: 202303152201