Acquia DAM CVE-2025-9954

Exploitation requires that the vulnerable Acquia DAM module (any version from 0.0.0 up to but not including 1.1.5) be installed and enabled on a network-reachable Drupal site, with DAM-managed assets or endpoints that are intended to be access-controlled. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as required - a remote unauthenticated attacker can directly request resources the authorization layer fails to protect. The practical limiting factors are: the site must run an affected pre-1.1.5 version of this specific module, and the impact is confined to unauthorized disclosure of assets/resources (C:H, I:N, A:N) - no modification or service disruption. Sites already upgraded to 1.1.5 or without the module installed are not exposed.

This is a genuine but moderate-priority issue rather than a critical emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) indicates remote, unauthenticated, low-complexity access with high confidentiality impact but no integrity or availability impact - consistent with a Missing Authorization / Forceful Browsing flaw (CWE-862) that exposes restricted assets. The EPSS score is low at 0.31% (22nd percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT listed in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. These signals are internally consistent: a high-CVSS confidentiality issue that is easy to trigger in principle, but with no current exploitation momentum. No SSVC decision data was provided in the input, so automatable/technical-impact framing cannot be independently derived. The main divergence worth noting is between the high CVSS base score and the low EPSS/absence of KEV - this points to a real but not widely-weaponized data-exposure bug. Confidentiality-only impact (I:N/A:N) means an attacker could read/retrieve protected digital assets but not modify data or disrupt service.

An unauthenticated attacker enumerates or guesses URLs/endpoints exposed by the Acquia DAM Drupal module and directly requests protected digital assets or administrative/asset resources that should require authorization, retrieving them without any credentials (forceful browsing). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to the site and no user interaction. No public proof-of-concept was identified in the provided data.