CVE-2022-42351: adobe experience_manager Incorrect Authorization

Vulnerability summary

CVE-2022-42351 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in adobe experience_manager. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.6% of scored vulnerabilities.

Timeline

1. 19-12-2022
   PublishedVulnerability first disclosed.
2. 23-04-2025
   Last modifiedVulnerability information updated.

Description

Adobe Experience Manager version 6.5.14 (and earlier) is affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to disclose low level confidentiality information. Exploitation of this issue does not require user interaction.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.