Aem Groovy console enabled

Adobe Experience Manager(AEM) provides an interface called AEM Groovy console to run Groovy scripts. The Groovy scripts can be used to tamper contents in JCR, call OSGi services, or execute arbitrary code using AEM, Sling, or certain APIs in JCR.

Impact

If the groovy console is exposed, an attacker can perform RCE.

Mitigation / Precaution

• We suggest you to update the AEM Groovy console to the latest version.

Written by

Febna V M

Cyber Security Engineer