CVE-2023-47065 : What You Need to Know

This article provides detailed information about CVE-2023-47065, a Cross-site Scripting vulnerability affecting Adobe Experience Manager versions 6.5.18 and earlier.

Understanding CVE-2023-47065

Adobe Experience Manager versions 6.5.18 and earlier are impacted by a Cross-site Scripting (DOM-based XSS) vulnerability that allows a low-privileged attacker to execute malicious JavaScript content in the victim's browser context.

What is CVE-2023-47065?

CVE-2023-47065 is a security vulnerability in Adobe Experience Manager versions 6.5.18 and earlier that enables attackers to execute malicious scripts in the context of a user's browser by tricking them into visiting a compromised URL.

The Impact of CVE-2023-47065

This vulnerability has a CVSS base score of 5.4, with a medium severity level. Attackers with low privileges can exploit this vulnerability, potentially compromising the confidentiality and integrity of user data.

Technical Details of CVE-2023-47065

The vulnerability arises in

/libs/cq/gui/components/authoring/editors/clientlibs/core/js/actions/WorkflowActivator.js

file within Adobe Experience Manager.

Vulnerability Description

Affected versions of Adobe Experience Manager are prone to DOM-based XSS attacks where attackers can execute malicious scripts in the victim's browser by manipulating vulnerable URLs.

Affected Systems and Versions

Product: Adobe Experience Manager
Vendor: Adobe
Affected Version: 6.5.18 and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability by luring users to visit a URL that references a compromised page, allowing the execution of malicious JavaScript in the victim's browser.

Mitigation and Prevention

To protect systems from CVE-2023-47065, users and administrators should take immediate remediation steps and implement long-term security practices.

Immediate Steps to Take

Update Adobe Experience Manager to a non-vulnerable version promptly.
Educate users on the risks of visiting unknown or suspicious URLs.

Long-Term Security Practices

Regularly monitor security advisories from Adobe for any new updates.
Implement web application firewalls and input validation techniques to mitigate XSS vulnerabilities.

Patching and Updates

Adobe has released a security advisory (APSB23-72) detailing the vulnerability and providing guidance on patching. Ensure to apply the recommended patches and updates to safeguard the system against potential exploits.