Adobe Experience Manager 6.0 < 11.8 Multiple Arbitrary code execution (APSB26-34)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306390);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/20");

  script_cve_id(
    "CVE-2026-27288",
    "CVE-2026-34623",
    "CVE-2026-34624",
    "CVE-2026-34625"
  );
  script_xref(name:"IAVA", value:"2026-A-0334");

  script_name(english:"Adobe Experience Manager 6.0 < 11.8 Multiple Arbitrary code execution (APSB26-34)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior to 11.8. It is, therefore, affected by
multiple vulnerabilities as referenced in the APSB26-34 advisory.

  - Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site
    Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to
    execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue
    requires user interaction in that a victim must visit a crafted webpage. (CVE-2026-27288, CVE-2026-34624,
    CVE-2026-34625)

  - Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site
    Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to
    execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue
    requires user interaction in that a victim must visit a specially crafted web page. (CVE-2026-34623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb26-34.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?99aa55b8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Experience Manager version 11.8 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34625");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-27288");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.0', 'fixed_version' : '11.8' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);