Vulnerability · Published Sep 27, 2021 · Assigned by adobe
CVE-2021-40713Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack
Medium 5.9
In plain English
A medium-severity improper certificate validation in Experience Manager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)1.0%top 35.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper certificate validation vulnerability in the cold storage component. If an attacker can achieve a man in the middle when the cold server establishes a new certificate, they would be able to harvest sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Experience Manager | unspecified – through 6.5.9.0unspecified – through None |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N