CVE-2021-21084: 
Adobe Experience Manager vulnerability analysis and mitigation

AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. The vulnerability was discovered in December 2020 and publicly disclosed in May 2021 (NVD, CVE).

The vulnerability (CVE-2021-21084) is a stored Cross-Site Scripting (XSS) vulnerability where malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. The CVSS v3.1 base score is 6.1 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N according to NVD, while Adobe rated it as 7.3 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (NVD).

If successfully exploited, the vulnerability allows attackers to inject malicious scripts that can be executed in victims' browsers when they visit the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability requires user interaction as the victim must browse to the page containing the injected malicious script. The attack complexity is rated as low, indicating that the exploitation is straightforward once the attacker has identified the vulnerable form fields (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade to versions newer than AEM 6.5.7.0, 6.4.8.3, or 6.3.3.8 depending on their current version track (Adobe Security).

The vulnerability was part of Adobe's May 2021 Patch Tuesday updates. Security researchers noted that Experience Manager should be prioritized for patching as the product has historically been at elevated risk (Help Net Security).