CVE-2017-3108

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability

published August 11, 2017

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

⚠️ A sneaky setup in Adobe Experience Manager lets malicious files slip through undetected! Anyone still using version 6.2 or earlier might find themselves in hot water. 🔥 Think of it like a restaurant kitchen where a sneaky chef can slip in a dish that wasn't on the menu — if no one checks the orders, that dangerous recipe might end up on a customer’s plate! An attacker could potentially execute malicious files, leading to unauthorized access or manipulation of sensitive data within the system. This could compromise the integrity and availability of your content, leaving your digital assets vulnerable.

Put simply

Think of it like a restaurant kitchen where a sneaky chef can slip in a dish that wasn't on the menu — if no one checks the orders, that dangerous recipe might end up on a customer’s plate! This vulnerability allows attackers to execute arbitrary files on the server due to insufficient validation of file types uploaded. Adobe Experience Manager fails to properly handle malicious files, creating opportunities for exploitation.

What to do

An attacker could potentially execute malicious files, leading to unauthorized access or manipulation of sensitive data within the system. This could compromise the integrity and availability of your content, leaving your digital assets vulnerable. To protect your system, upgrade Adobe Experience Manager to the latest version immediately. Review file upload restrictions and ensure proper validation mechanisms are in place to prevent unauthorized file types from being processed. You’ve got this! With these steps, you’ll shore up your defenses in no time! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08624 · 95.1th percentile
Published
2017-08-11T19:00Z
EPSS history
Timeline
  • 11 AUG 19:00Z
    Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability
    cvelistv5