CVE-2020-9732: 
Adobe Experience Manager vulnerability analysis and mitigation

The Adobe Experience Manager (AEM) Forms add-on versions 6.5.5.0 (and below) and 6.4.8.2 (and below) were affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-9732. The vulnerability was discovered and reported to Adobe Systems Incorporated on March 2, 2020, and was publicly disclosed on September 8, 2020 (CVE Details, NVD).

The vulnerability is classified as a stored XSS issue that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. The severity of this vulnerability is rated as Critical with a CVSS v3.1 Base Score of 9.0, and the vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the victim's browser when they open a page containing the vulnerable field. The critical nature of this flaw could potentially lead to the release of private information, lateral movement through a network, or the hijacking of critical information due to the heavy use of these tools in marketing and their access to critical information (Threatpost).

The vulnerability requires an authenticated user with 'Author' privileges to store malicious scripts, which can then be executed when other users access the affected page. Adobe assigned this vulnerability a Priority 2 rating, indicating that while the product has historically been at elevated risk, there were no known exploits in the wild at the time of disclosure (Threatpost).

Adobe addressed this vulnerability by releasing patches in version 6.5.6.0 and version 6.4.8.2, as well as AEM Forms Service Pack 6 for AEM forms add-on users. Adobe recommended administrators install the update within 30 days of release as a best practice (Adobe Advisory).