Adobe Experience Manager < 6.5.23 (GRANITE-61551 Hotfix) / 6.5 LTS SP1 (GRANITE-61551 Hotfix) Multiple Security feature bypass (APSB25-90)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(264629);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-54246",
    "CVE-2025-54247",
    "CVE-2025-54248",
    "CVE-2025-54249",
    "CVE-2025-54250",
    "CVE-2025-54251",
    "CVE-2025-54252"
  );
  script_xref(name:"IAVA", value:"2025-A-0651-S");

  script_name(english:"Adobe Experience Manager < 6.5.23 (GRANITE-61551 Hotfix) / 6.5 LTS SP1 (GRANITE-61551 Hotfix) Multiple Security feature bypass (APSB25-90)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior or equal to 6.5.23. It is, therefore, 
might be affected by multiple vulnerabilities as referenced in the APSB25-90 advisory.

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery
    (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could
    leverage this vulnerability to manipulate server-side requests and bypass security controls allowing
    unauthorized read access. (CVE-2025-54249)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation
    vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage
    this vulnerability to bypass security measures and gain unauthorized read access. Scope is changed
    (CVE-2025-54248)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization
    vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage
    this vulnerability to bypass security measures and gain unauthorized write access. (CVE-2025-54246)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation
    vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage
    this vulnerability to bypass security measures and gain unauthorized read access. (CVE-2025-54247)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation
    vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage
    this vulnerability to bypass security measures and gain unauthorized write access. (CVE-2025-54250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?103fc681");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54249");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-54248");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 79, 863, 91, 918);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/12");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('http.inc');

if(report_paranoia < 2)
  audit(AUDIT_PARANOID);

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.5.0', 'max_version' : '6.5.23', 'fixed_display' : 'See vendor advisory' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);