title: ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability
description: Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An unauthenticated attacker can abuse this vulnerability to access the API and leak default admin's password. Exploitation of this issue does not require user interaction.
problem types: Improper Authentication (CWE-287)
affected:
{
defaultStatus: affected
product: Adobe Framemaker Publishing Server
vendor: Adobe
versions:
lessThanOrEqual: v2022, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
availabilityRequirement: NOT_DEFINED
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
confidentialityRequirement: NOT_DEFINED
environmentalScore: 9.8
environmentalSeverity: CRITICAL
exploitCodeMaturity: NOT_DEFINED
integrityImpact: HIGH
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: HIGH
modifiedConfidentialityImpact: HIGH
modifiedIntegrityImpact: HIGH
modifiedPrivilegesRequired: NONE
modifiedScope: NOT_DEFINED
modifiedUserInteraction: NONE
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 9.8
temporalSeverity: CRITICAL
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL