CVE-2023-22265 - OpenCVE

Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Adobe	Experience Manager Cloud Service Experience Manager

Configuration 1 [-]

OR	cpe:2.3:a:adobe:experience_manager::::::::
	cpe:2.3:a:adobe:experience_manager_cloud_service::::::::

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: adobe

Published: 2023-03-22T00:00:00

Updated: 2023-03-31T00:00:00

Reserved: 2022-12-19T00:00:00

Link: CVE-2023-22265

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-03-22T17:15:14.687

Modified: 2023-12-20T21:21:30.387

Link: CVE-2023-22265

JSON object: View

Redhat Information

No data.

CWE

CWE-601

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "57E7937E-BEB6-4DEA-A37D-37690D421025", "versionEndExcluding": "6.5.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:experience_manager_cloud_service:*:*:*:*:*:*:*:*", "matchCriteriaId": "81AD871B-AB64-4FE4-944C-4BB0D9BDDAFE", "versionEndExcluding": "2023.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Experience Manager versions 6.5.15.0 (and earlier) are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction."}], "id": "CVE-2023-22265", "lastModified": "2023-12-20T21:21:30.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "psirt@adobe.com", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2023-03-22T17:15:14.687", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/experience-manager/apsb23-18.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-601"}], "source": "psirt@adobe.com", "type": "Secondary"}]}