Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Adobe Experience Manager may leak sensitive data

CVE-2019-16469 · published 6 years ago
Summary

Versions 6.0 through 6.5 of Adobe Experience Manager can be tricked into revealing private information. This happens because the software can be made to run unexpected commands when processing certain inputs. Apply the latest security updates from Adobe or restrict input handling to prevent exploitation.

What to do
  • Update adobe experience_manager to version 6.5.3.0 or later.
Affected software
VendorProductAffected versions
adobe experience_manager >= 6.5.0, < 6.5.3.0
cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*
Original advisory text
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
17% chance of attack within 30 days
Type
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Timeline
Published15 Jan 2020
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-16469 · NVD
Track software like this
Free during beta