Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypass
Priority HIGH 82CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Adobe FrameMaker Publishing Server versions 2022.1 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass authentication mechanisms and gain unauthorized access. Exploitation of this issue does not require user interaction.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01062 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Adobe Framemaker Publishing Server | up to 2022.1 | — | No fix listed | CNA |
- Adobe Framemaker Publishing Server VendorAdobe Affected up to 2022.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:framemaker_publishing_server:*:*:*:*:*:*:*:* | before 2022 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2022:-:*:*:*:*:*:* | 2022 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:framemaker_publishing_server:2022:update1:*:*:*:*:*:* | 2022 update1 | Vulnerable | Adobe |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:adobe:framemaker_publishing_server:*:*:*:*:*:*:*:* Versions before 2022 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2022:-:*:*:*:*:*:* Versions 2022 Vulnerable ·Adobe
- cpe:2.3:a:adobe:framemaker_publishing_server:2022:update1:*:*:*:*:*:* Versions 2022 update1 Vulnerable ·Adobe
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-20738
- 2026-10-03 Alias added: GHSA-xfgj-9gc9-r597
References
More Adobe Framemaker Publishing Server vulnerabilities
- TI-2023-23841 ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-20043 Tenable Vulnerability Disclosure | API Auth Bypass CVSS 3.1CRITICAL 10.0
- TI-2024-20044 Tenable Vulnerability Disclosure | Sensitive Information Disclosure Via Fake FMPS Worker CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-20738 · CVE Program
- CVE-2024-20738 · NVD
- FIRST EPSS
- GHSA-xfgj-9gc9-r597 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences