CVE-2021-43765: 
Adobe Experience Manager vulnerability analysis and mitigation

AEM's Cloud Service offering and version 6.5.10.0 (and below) were affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2021-43765) that was disclosed on January 13, 2022. The vulnerability could be exploited by attackers to inject malicious scripts into vulnerable form fields (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (CWE-79) issue, with a CVSS v3.1 base score of 8.1 (HIGH) according to Adobe's assessment (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The NVD assessment differs slightly with a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

When successfully exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could lead to unauthorized access to sensitive information and potential manipulation of user data (NVD).

Adobe has addressed this vulnerability in subsequent releases after version 6.5.10.0. Users are advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (Adobe Advisory).