CVE-2021-28627

Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interaction.

CVSS v3 5.4 MEDIUM
CVSS v2.0 6.5 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb21-39.html	Vendor Advisory
https://helpx.adobe.com/security/products/experience-manager/apsb21-39.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*

History

19 Sep 2025, 17:19

Type	Values Removed	Values Added
CPE	cpe:2.3:a:adobe:experience_manager:::::cloud_service:::*	cpe:2.3:a:adobe:experience_manager:::::aem_cloud_service:::*

Information

Published : 2021-08-24 18:15

Updated : 2025-09-19 17:19

NVD link : CVE-2021-28627

Mitre link : CVE-2021-28627

CVE.ORG link : CVE-2021-28627

JSON object : View

Products Affected

adobe

experience_manager

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2021-28627", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-08-24T18:15:10.877", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb21-39.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "https://helpx.adobe.com/security/products/experience-manager/apsb21-39.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Server-side Request Forgery. An authenticated attacker could leverage this vulnerability to contact systems blocked by the dispatcher. Exploitation of this issue does not require user interaction."}, {"lang": "es", "value": "Adobe Experience Manager Cloud Service offering, as\u00ed como las versiones 6.5.8.0 (y por debajo) est\u00e1n afectadas por una vulnerabilidad de tipo Server-side Request Forgery. Un atacante autenticado podr\u00eda aprovechar esta vulnerabilidad para ponerse en contacto con los sistemas bloqueados por el despachador. No es requerida una interacci\u00f3n del usuario para la explotaci\u00f3n de este problema."}], "lastModified": "2025-09-19T17:19:39.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*", "vulnerable": true, "matchCriteriaId": "CFE7F621-EA3F-4E1F-AE44-132106D371F3", "versionEndIncluding": "6.5.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}