CVE-2020-9644: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5 and earlier contain a stored cross-site scripting vulnerability identified as CVE-2020-9644. The vulnerability was disclosed on June 12, 2020, and affects multiple versions of the AEM platform (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

Successful exploitation of this vulnerability could lead to arbitrary JavaScript execution in the browser, potentially allowing attackers to perform malicious actions in the context of the affected user's session (NVD).

The vulnerability requires low privileges and user interaction for successful exploitation. The attack vector is network-accessible, and the attack complexity is considered low (NVD).

Adobe has released security updates to address this vulnerability. Users should update to the latest version of Adobe Experience Manager to mitigate this security risk (Adobe Security).

The vulnerability was discovered and reported by Thomas Hartmann of Netcentric (Adobe Security).