Adobe Experience Manager Improper Restriction of XML External Entity Reference Vulnerability Allowing Arbitrary File System Read

A vulnerability allowing improper restriction of XML external entity references (XXE) has been identified in Adobe Experience Manager (AEM) Forms on Java Enterprise Edition (JEE) versions 6.5.23.0 and earlier. This XXE vulnerability could be exploited to read arbitrary files from the local file system, potentially allowing access to sensitive information. The exploitation of this vulnerability does not require user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the local file system.

Remediation

Users are advised to update to Adobe Experience Manager (AEM) Forms on JEE version 6.5.0-0108. Update instructions are available on the Adobe Experience League website.