Adobe Experience Manager 6.0.0.0 < 6.5.25.0 Multiple Arbitrary code execution (APSB26-57)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320129);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/26");

  script_cve_id("CVE-2026-34691", "CVE-2026-34693", "CVE-2026-34694");
  script_xref(name:"IAVA", value:"2026-A-0580");
  script_xref(name:"IAVA", value:"2026-A-0587");

  script_name(english:"Adobe Experience Manager 6.0.0.0 < 6.5.25.0 Multiple Arbitrary code execution (APSB26-57)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Experience Manager instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Experience Manager installed on the remote host is prior to 6.5.25.0. It is, therefore, affected by
multiple vulnerabilities as referenced in the APSB26-57 advisory.

  - Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-
    Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into
    vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the
    page containing the vulnerable field, potentially gaining elevated access or control over the victim's
    account or session. Scope is changed. (CVE-2026-34691)

  - Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected
    Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious
    scripts into a web page, potentially gaining elevated access or control over the victim's account or
    session. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires
    user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web
    page. Scope is changed. (CVE-2026-34693)

  - Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-
    Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious
    scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they
    browse to the page containing the vulnerable field. Scope is changed. (CVE-2026-34694)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://helpx.adobe.com/security/products/experience-manager/apsb26-57.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?242effc3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Experience Manager version 6.5.25.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-34691");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/09");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:experience_manager");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_experience_manager_http_detect.nbin");
  script_require_keys("installed_sw/Adobe Experience Manager");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:4502);
var app_info = vcf::get_app_info(app:'Adobe Experience Manager', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '6.0.0.0', 'fixed_version' : '6.5.25.0' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);