############################################################# #
# COMPASS SECURITY ADVISORY http://www.csnc.ch/ ############################################################# # # CSNC ID: CSNC-2015-011 # CVE ID : CVE-2015-0955 # Product: Adobe Experience Manager (AEM) [1] # Vendor: Adobe [2] # Subject: Stored Cross-Site Scripting (XSS) Vulnerability # Risk: Important # Effect: Exploitable by Authenticated AEM Users # Author: Damian Pfammatter (damian.pfammat...@csnc.ch) # Date: February 23rd 2016 # ############################################################# Introduction: ------------- Adobe Experience Manager (AEM) is an enterprise-grade web content management solution for building websites, mobile apps and forms [1]. Security Analysts of Compass Security Schweiz AG [3] discovered a stored Cross-Site Scripting (XSS) vulnerability, which allows executing JavaScript code in a victim's context, potentially resulting in a number of different attack scenarios. For instance, the identified vulnerability could be used by a malicious AEM user to publish content in the name of another AEM user. Affected Versions: ------------------ AEM 6.1.0 Technical Description: ---------------------- Authenticated users in AEM, having permissions to create new folders, may place malicious JavaScript code into a folder's title field. Once such a folder gets deleted, the injected code is executed in the context of the user deleting the folder. The vulnerability arises due to improper output encoding of folder titles in the Deletion popup dialog. Amongst others, this stored XSS vulnerability could potentially be leveraged by a low-privileged AEM user to escalate its privileges. For example, a user having content management permissions only could create a folder, which when deleted by another, higher privileged AEM user, could assign him administrative privileges. Other type of XSS-related attacks - such as for instance redirecting other AEM users to websites abusing browser vulnerabilities to gain local access - might be possible. Hotfix: ------- Adobe has released a security hotfix (8651) [4] to address this issue. Timeline: --------- 2015-10-29: Vulnerability discovered 2015-11-23: Initial vendor notification 2015-12-01: Vendor confirmed security issue 2016-02-09: Vendor released security fix & guidance to its customers [4] 2016-02-23: Public disclosure References: ----------- [1]: https://www.adobe.com/marketing-cloud/enterprise-content-management.html [2]: https://www.adobe.com [3]: http://www.csnc.ch/advisories [4]: https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/