CVE-2020-24444: Blind SSRF in Forms add-on for AEM

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-10 · updated 2026-06-17
Weakness: CWE-918

Description

AEM Forms SP6 add-on for AEM 6.5.6.0 and Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 (6.4.8.2) have a blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability could be exploited by an unauthenticated attacker to gather information about internal systems that reside on the same network.

Affected products

Adobe Experience Manager Forms Add-On: 6.4.8.2, 6.5.6.0

References

https://helpx.adobe.com/security/products/experience-manager/apsb20-72.html
https://helpx.adobe.com/security/products/experience-manager/apsb20-72.html

Get alerted when CVE-2020-24444 or the next vulnerability affects your stack