CVE-2023-48476: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. The vulnerability was disclosed on December 15, 2023, and affects Adobe Experience Manager software (NVD).

The vulnerability is classified as a DOM-based Cross-site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires low privileges (PR:L), user interaction (UI:R), and has a changed scope (S:C). The impact affects both confidentiality and integrity at a low level (C:L/I:L) with no impact on availability (A:N) (NVD).

If successfully exploited, this vulnerability allows malicious JavaScript content to be executed within the context of the victim's browser when a low-privileged attacker convinces the victim to visit a URL referencing a vulnerable page (NVD).

The vulnerability requires a low-privileged attacker to convince a victim to visit a specifically crafted URL that references a vulnerable page. The attack complexity is considered low, but user interaction is required for successful exploitation (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade to the latest version of Adobe Experience Manager beyond version 6.5.18 (Adobe Advisory).