CVE-2023-48522: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-48522. The vulnerability was disclosed on December 15, 2023, affecting both AEM on-premises installations and cloud service versions prior to 2023.11 (NVD, Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that could be exploited by attackers with low privileges. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This scoring indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction for successful exploitation (NVD).

When successfully exploited, this vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to pages containing the compromised fields, the malicious JavaScript code executes in their browsers, potentially leading to unauthorized data access or manipulation (Adobe Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Experience Manager installations to versions after 6.5.18, or for cloud service users, to version 2023.11 or later (Adobe Advisory).