Vulnerability identifier: #VU13628

Vulnerability risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-5006

CWE-ID: CWE-918

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Adobe Experience Manager
Client/Desktop applications / Office applications

Vendor: Adobe

Description
The vulnerability allows a remote user to perform SSRF attack.

The weakness exists due to unspecified error. A remote attacker can perform SSRF attack to bypass network access controls, perform unauthorized connections to local resources and gain access to sensitive information.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Adobe Experience Manager: 6.0 - 6.4

---

External links
http://helpx.adobe.com//security/products/experience-manager/apsb18-23.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.