CVE-2020-24444 is a blind Server-Side Request Forgery (SSRF) vulnerability affecting Adobe Experience Manager (AEM) Forms SP6 add-on for AEM 6.5.6.0 and the Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2). This vulnerability allows an unauthenticated attacker to gather information about internal systems on the same network. The vulnerability has a CVSS score of 5.8 (Medium), indicating a network-based attack with low complexity and no user interaction required, potentially leading to a partial compromise of confidentiality. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 29/100. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one mention and one article, respectively.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.4.8.2CPE matchmatch criteria | cpe:2.3:a:adobe:experience_manager_forms_add-on:6.4.8.2:*:*:*:*:*:*:* | ||
6.5.6.0CPE matchmatch criteria | cpe:2.3:a:adobe:experience_manager_forms_add-on:6.5.6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.