CVE-2025-54249

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:adobe:experience_manager:::::-:::*
	cpe:2.3:a:adobe:experience_manager:::::aem_cloud_service:::*
	cpe:2.3:a:adobe:experience_manager:6.5:-:::lts:::*
	cpe:2.3:a:adobe:experience_manager:6.5:sp1:::lts:::*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Versiones 6.5.23.0 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) que podría resultar en una omisión de característica de seguridad. Un atacante con pocos privilegios podría aprovechar esta vulnerabilidad para manipular peticiones del lado del servidor y omitir controles de seguridad, permitiendo acceso de lectura no autorizado.

Information

Published : 2025-09-09 17:15

Updated : 2026-09-30 23:10

NVD link : CVE-2025-54249

Mitre link : CVE-2025-54249

CVE.ORG link : CVE-2025-54249

JSON object : View

Products Affected

adobe

experience_manager

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-54249", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54249", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-09T17:09:09.322837Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Experience Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.5.23.0"}], "defaultStatus": "affected"}]}], "published": "2025-09-09T17:15:58.663", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access."}, {"lang": "es", "value": "Versiones 6.5.23.0 y anteriores de Adobe Experience Manager est\u00e1n afectadas por una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que podr\u00eda resultar en una omisi\u00f3n de caracter\u00edstica de seguridad. Un atacante con pocos privilegios podr\u00eda aprovechar esta vulnerabilidad para manipular peticiones del lado del servidor y omitir controles de seguridad, permitiendo acceso de lectura no autorizado."}], "lastModified": "2026-09-30T23:10:00.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "2FFEE087-8858-44D0-8D12-9196F0E33ADA", "versionEndIncluding": "6.5.23.0"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*", "vulnerable": true, "matchCriteriaId": "2A9F7972-FCFA-43C8-A3CD-5895096B4767", "versionEndIncluding": "2025.8.0"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F"}, {"criteria": "cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "00DDCBAD-1FEF-487F-97BB-481DC02F493A"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}