title: Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service
description: AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the current user.
problem types: Improper Access Control (CWE-284)
affected:
{
product: Experience Manager
vendor: Adobe
versions:
lessThanOrEqual: 6.3.3.8, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.4.8.3, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 6.5.7.0, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: AEM Cloud Service, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]