某些 Creative Cloud 应用程序、服务和功能在中国不可用。
Adobe has released security updates for Adobe Experience Manager. These updates resolve a reflected cross-site scripting vulnerability rated moderate in the HtmlRendererServlet (CVE-2017-3109), an information disclosure vulnerability (CVE-2017-3111) rated important in which a sensitive token is included in an http GET request under certain circumstances, and a cross-site scripting vulnerability (CVE-2017-11296) in Apache Sling Servlets Post 2.3.20 rated important.
Opomba:
The HtmlRendererServlet should be disabled in production systems. Please see Running AEM in Production Ready Mode for more details.
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
| Product | Version | Platform | Priority | Availability |
| Adobe Experience Manager |
6.3 |
All | 3 | Release note |
| 6.2 | All | 3 | Release note |
|
| 6.1 | All | 3 | Release note |
|
| 6.0 | All | 3 | Release note |
Please contact Adobe customer care for assistance with earlier AEM versions.
| Vulnerability Category | Vulnerability Impact | Severity | CVE Numbers | Affected Version | Download Package |
| Reflected cross-site scripting | Information disclosure |
Moderate |
CVE-2017-3109 |
AEM 6.3 and earlier |
Cumulative Fix Pack for 6.1 SP2 - AEM-6.1-SP2-CFP9 |
| Sensitive token in HTTP GET request | Information disclosure | Important | CVE-2017-3111 |
AEM 6.1, AEM 6.2 | Cumulative Fix Pack for 6.1 SP2 - AEM-6.1-SP2-CFP12 Cumulative Fix Pack for 6.2 SP1 - AEM-6.2-SP1-CFP2 |
| Cross-site scripting |
Information disclosure | Important | CVE-2017-11296 | AEM 6.3 and earlier |
Cumulative Fix Pack for 6.1 SP2 - AEM-6.1-SP2-CFP12 Cumulative Fix Pack for 6.2 SP1 - AEM-6.2-SP1-CFP6 Cumulative Fix Pack for AEM-CFP-6.3.0.2
|
Opomba:
The packages listed in the table above are the minimum fix packs to address the listed vulnerability. For the latest versions, please see the release notes links referenced above.