Adobe Experience Manager 6.5.0 < 6.5.23 Multiple Vulnerabilities (APSB25-48)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(238053);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-46837",
    "CVE-2025-46838",
    "CVE-2025-46840",
    "CVE-2025-46841",
    "CVE-2025-46842",
    "CVE-2025-46843",
    "CVE-2025-46844",
    "CVE-2025-46845",
    "CVE-2025-46846",
    "CVE-2025-46847",
    "CVE-2025-46848",
    "CVE-2025-46850",
    "CVE-2025-46851",
    "CVE-2025-46853",
    "CVE-2025-46854",
    "CVE-2025-46855",
    "CVE-2025-46857",
    "CVE-2025-46858",
    "CVE-2025-46859",
    "CVE-2025-46860",
    "CVE-2025-46861",
    "CVE-2025-46862",
    "CVE-2025-46863",
    "CVE-2025-46864",
    "CVE-2025-46865",
    "CVE-2025-46866",
    "CVE-2025-46870",
    "CVE-2025-46871",
    "CVE-2025-46872",
    "CVE-2025-46873",
    "CVE-2025-46874",
    "CVE-2025-46875",
    "CVE-2025-46876",
    "CVE-2025-46877",
    "CVE-2025-46878",
    "CVE-2025-46879",
    "CVE-2025-46880",
    "CVE-2025-46881",
    "CVE-2025-46882",
    "CVE-2025-46883",
    "CVE-2025-46884",
    "CVE-2025-46885",
    "CVE-2025-46886",
    "CVE-2025-46887",
    "CVE-2025-46888",
    "CVE-2025-46889",
    "CVE-2025-46890",
    "CVE-2025-46891",
    "CVE-2025-46892",
    "CVE-2025-46893",
    "CVE-2025-46894",
    "CVE-2025-46895",
    "CVE-2025-46898",
    "CVE-2025-46899",
    "CVE-2025-46900",
    "CVE-2025-46901",
    "CVE-2025-46902",
    "CVE-2025-46903",
    "CVE-2025-46904",
    "CVE-2025-46905",
    "CVE-2025-46906",
    "CVE-2025-46907",
    "CVE-2025-46908",
    "CVE-2025-46909",
    "CVE-2025-46910",
    "CVE-2025-46911",
    "CVE-2025-46912",
    "CVE-2025-46913",
    "CVE-2025-46914",
    "CVE-2025-46915",
    "CVE-2025-46916",
    "CVE-2025-46917",
    "CVE-2025-46918",
    "CVE-2025-46919",
    "CVE-2025-46920",
    "CVE-2025-46922",
    "CVE-2025-46923",
    "CVE-2025-46924",
    "CVE-2025-46926",
    "CVE-2025-46927",
    "CVE-2025-46929",
    "CVE-2025-46930",
    "CVE-2025-46931",
    "CVE-2025-46933",
    "CVE-2025-46934",
    "CVE-2025-46935",
    "CVE-2025-46939",
    "CVE-2025-46940",
    "CVE-2025-46941",
    "CVE-2025-46942",
    "CVE-2025-46943",
    "CVE-2025-46944",
    "CVE-2025-46945",
    "CVE-2025-46946",
    "CVE-2025-46947",
    "CVE-2025-46950",
    "CVE-2025-46953",
    "CVE-2025-46954",
    "CVE-2025-46955",
    "CVE-2025-46956",
    "CVE-2025-46957",
    "CVE-2025-46958",
    "CVE-2025-46959",
    "CVE-2025-46960",
    "CVE-2025-46963",
    "CVE-2025-46964",
    "CVE-2025-46965",
    "CVE-2025-46966",
    "CVE-2025-46967",
    "CVE-2025-46968",
    "CVE-2025-46970",
    "CVE-2025-46971",
    "CVE-2025-46972",
    "CVE-2025-46973",
    "CVE-2025-46974",
    "CVE-2025-46975",
    "CVE-2025-46976",
    "CVE-2025-46977",
    "CVE-2025-46978",
    "CVE-2025-46979",
    "CVE-2025-46981",
    "CVE-2025-46982",
    "CVE-2025-46983",
    "CVE-2025-46984",
    "CVE-2025-46985",
    "CVE-2025-46986",
    "CVE-2025-46987",
    "CVE-2025-46988",
    "CVE-2025-46989",
    "CVE-2025-46990",
    "CVE-2025-46991",
    "CVE-2025-46992",
    "CVE-2025-46995",
    "CVE-2025-46997",
    "CVE-2025-46999",
    "CVE-2025-47000",
    "CVE-2025-47002",
    "CVE-2025-47003",
    "CVE-2025-47004",
    "CVE-2025-47005",
    "CVE-2025-47006",
    "CVE-2025-47007",
    "CVE-2025-47008",
    "CVE-2025-47010",
    "CVE-2025-47011",
    "CVE-2025-47012",
    "CVE-2025-47013",
    "CVE-2025-47014",
    "CVE-2025-47015",
    "CVE-2025-47016",
    "CVE-2025-47017",
    "CVE-2025-47019",
    "CVE-2025-47020",
    "CVE-2025-47021",
    "CVE-2025-47022",
    "CVE-2025-47025",
    "CVE-2025-47026",
    "CVE-2025-47027",
    "CVE-2025-47029",
    "CVE-2025-47030",
    "CVE-2025-47031",
    "CVE-2025-47032",
    "CVE-2025-47033",
    "CVE-2025-47034",
    "CVE-2025-47035",
    "CVE-2025-47036",
    "CVE-2025-47037",
    "CVE-2025-47038",
    "CVE-2025-47039",
    "CVE-2025-47040",
    "CVE-2025-47041",
    "CVE-2025-47042",
    "CVE-2025-47044",
    "CVE-2025-47045",
    "CVE-2025-47047",
    "CVE-2025-47048",
    "CVE-2025-47049",
    "CVE-2025-47050",
    "CVE-2025-47051",
    "CVE-2025-47052",
    "CVE-2025-47055",
    "CVE-2025-47056",
    "CVE-2025-47057",
    "CVE-2025-47060",
    "CVE-2025-47062",
    "CVE-2025-47063",
    "CVE-2025-47065",
    "CVE-2025-47066",
    "CVE-2025-47067",
    "CVE-2025-47068",
    "CVE-2025-47069",
    "CVE-2025-47070",
    "CVE-2025-47071",
    "CVE-2025-47072",
    "CVE-2025-47073",
    "CVE-2025-47074",
    "CVE-2025-47075",
    "CVE-2025-47076",
    "CVE-2025-47077",
    "CVE-2025-47078",
    "CVE-2025-47079",
    "CVE-2025-47080",
    "CVE-2025-47081",
    "CVE-2025-47082",
    "CVE-2025-47083",
    "CVE-2025-47084",
    "CVE-2025-47085",
    "CVE-2025-47086",
    "CVE-2025-47087",
    "CVE-2025-47088",
    "CVE-2025-47089",
    "CVE-2025-47090",
    "CVE-2025-47091",
    "CVE-2025-47092",
    "CVE-2025-47093",
    "CVE-2025-47094",
    "CVE-2025-47096",
    "CVE-2025-47100",
    "CVE-2025-47113",
    "CVE-2025-47114",
    "CVE-2025-47115",
    "CVE-2025-47116",
    "CVE-2025-47117"
  );
  script_xref(name:"IAVA", value:"2025-A-0427-S");

  script_name(english:"Adobe Experience Manager 6.5.0 < 6.5.23 Multiple Vulnerabilities (APSB25-48)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior to 6.5.23. It is, therefore, affected by
multiple vulnerabilities as referenced in the APSB25-48 advisory.

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization
    vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this
    vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue
    requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing
    the confidentiality and integrity impact as high. (CVE-2025-46840)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting
    (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into
    vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the
    page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover,
    increasing the confidentiality and integrity impact as high. (CVE-2025-46837)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS)
    vulnerability that could be abused by a low privileged attacker to inject malicious scripts into
    vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the
    page containing the vulnerable field. (CVE-2025-46838, CVE-2025-46841, CVE-2025-46842, CVE-2025-46843,
    CVE-2025-46844, CVE-2025-46845, CVE-2025-46846, CVE-2025-46847, CVE-2025-46848, CVE-2025-46850,
    CVE-2025-46851, CVE-2025-46853, CVE-2025-46854, CVE-2025-46855, CVE-2025-46858, CVE-2025-46859,
    CVE-2025-46860, CVE-2025-46861, CVE-2025-46862, CVE-2025-46863, CVE-2025-46864, CVE-2025-46865,
    CVE-2025-46866, CVE-2025-46870, CVE-2025-46871, CVE-2025-46872, CVE-2025-46873, CVE-2025-46876,
    CVE-2025-46877, CVE-2025-46878, CVE-2025-46879, CVE-2025-46880, CVE-2025-46881, CVE-2025-46882,
    CVE-2025-46883, CVE-2025-46885, CVE-2025-46886, CVE-2025-46887, CVE-2025-46888, CVE-2025-46890,
    CVE-2025-46891, CVE-2025-46892, CVE-2025-46893, CVE-2025-46894, CVE-2025-46895, CVE-2025-46898,
    CVE-2025-46899, CVE-2025-46900, CVE-2025-46901, CVE-2025-46902, CVE-2025-46903, CVE-2025-46904,
    CVE-2025-46905, CVE-2025-46906, CVE-2025-46907, CVE-2025-46908, CVE-2025-46909, CVE-2025-46910,
    CVE-2025-46912, CVE-2025-46914, CVE-2025-46915, CVE-2025-46916, CVE-2025-46917, CVE-2025-46918,
    CVE-2025-46919, CVE-2025-46920, CVE-2025-46922, CVE-2025-46923, CVE-2025-46924, CVE-2025-46926,
    CVE-2025-46927, CVE-2025-46929, CVE-2025-46930, CVE-2025-46931, CVE-2025-46933, CVE-2025-46934,
    CVE-2025-46935, CVE-2025-46939, CVE-2025-46940, CVE-2025-46941, CVE-2025-46942, CVE-2025-46943,
    CVE-2025-46944, CVE-2025-46945, CVE-2025-46946, CVE-2025-46947, CVE-2025-46950, CVE-2025-46953,
    CVE-2025-46954, CVE-2025-46955, CVE-2025-46956, CVE-2025-46957, CVE-2025-46960, CVE-2025-46963,
    CVE-2025-46964, CVE-2025-46965, CVE-2025-46966, CVE-2025-46967, CVE-2025-46968, CVE-2025-46970,
    CVE-2025-46971, CVE-2025-46972, CVE-2025-46973, CVE-2025-46974, CVE-2025-46975, CVE-2025-46976,
    CVE-2025-46977, CVE-2025-46978, CVE-2025-46979, CVE-2025-46981, CVE-2025-46982, CVE-2025-46983,
    CVE-2025-46984, CVE-2025-46985, CVE-2025-46986, CVE-2025-46987, CVE-2025-46988, CVE-2025-46989,
    CVE-2025-46990, CVE-2025-46991, CVE-2025-46992, CVE-2025-46995, CVE-2025-46997, CVE-2025-46999,
    CVE-2025-47000, CVE-2025-47002, CVE-2025-47003, CVE-2025-47004, CVE-2025-47005, CVE-2025-47006,
    CVE-2025-47007, CVE-2025-47008, CVE-2025-47010, CVE-2025-47011, CVE-2025-47012, CVE-2025-47013,
    CVE-2025-47014, CVE-2025-47015, CVE-2025-47016, CVE-2025-47017, CVE-2025-47019, CVE-2025-47020,
    CVE-2025-47021, CVE-2025-47022, CVE-2025-47025, CVE-2025-47026, CVE-2025-47027, CVE-2025-47029,
    CVE-2025-47030, CVE-2025-47031, CVE-2025-47032, CVE-2025-47033, CVE-2025-47034, CVE-2025-47035,
    CVE-2025-47036, CVE-2025-47037, CVE-2025-47038, CVE-2025-47039, CVE-2025-47040, CVE-2025-47041,
    CVE-2025-47042, CVE-2025-47044, CVE-2025-47045, CVE-2025-47047, CVE-2025-47048, CVE-2025-47050,
    CVE-2025-47051, CVE-2025-47052, CVE-2025-47055, CVE-2025-47056, CVE-2025-47057, CVE-2025-47060,
    CVE-2025-47062, CVE-2025-47063, CVE-2025-47065, CVE-2025-47066, CVE-2025-47067, CVE-2025-47068,
    CVE-2025-47069, CVE-2025-47070, CVE-2025-47071, CVE-2025-47072, CVE-2025-47073, CVE-2025-47074,
    CVE-2025-47075, CVE-2025-47076, CVE-2025-47077, CVE-2025-47078, CVE-2025-47079, CVE-2025-47080,
    CVE-2025-47081, CVE-2025-47082, CVE-2025-47083, CVE-2025-47084, CVE-2025-47085, CVE-2025-47086,
    CVE-2025-47087, CVE-2025-47088, CVE-2025-47089, CVE-2025-47090, CVE-2025-47091, CVE-2025-47092,
    CVE-2025-47093, CVE-2025-47113, CVE-2025-47114, CVE-2025-47115, CVE-2025-47116, CVE-2025-47117)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting
    (XSS) vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing
    a vulnerable page, malicious JavaScript content may be executed within the context of the victim's
    browser. (CVE-2025-46857, CVE-2025-46874, CVE-2025-46875)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS)
    vulnerability that could be abused by a high privileged attacker to inject malicious scripts into
    vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the
    page containing the vulnerable field. (CVE-2025-46884, CVE-2025-46911, CVE-2025-46913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?29ce0117");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Experience Manager version 6.5.23 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-46840");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 284, 285, 79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.5.0', 'fixed_version' : '6.5.23' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);