CVE-2023-48550: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on December 15, 2023, with CVE identifier CVE-2023-48550. This security issue affects Adobe Experience Manager installations up to version 6.5.18.0 and Adobe Experience Manager Cloud Service versions up to 2023.11 (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that could be exploited by a low-privileged attacker. The CVSS v3.1 base score is 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with impacts on confidentiality and integrity but not availability (Adobe Security Bulletin).

When successfully exploited, the vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the vulnerable field, the malicious JavaScript code may be executed in their browser context. This can potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. The fix is available through Adobe's security bulletin APSB23-72 (Adobe Security Bulletin).