CVE-2023-48554: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2023-48554. The vulnerability was disclosed on December 15, 2023, affecting Adobe Experience Manager's form field functionality (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that could allow malicious script injection into vulnerable form fields. The CVSS v3.1 base score is 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (Adobe Advisory).

When exploited, the vulnerability allows malicious JavaScript execution in a victim's browser when they browse to a page containing the compromised field. The impact is limited to confidentiality and integrity breaches, with no effect on availability (NVD).

The vulnerability requires a low-privileged attacker to inject malicious scripts into vulnerable form fields. The attack requires user interaction, as the malicious JavaScript is executed when victims browse to the affected page (Adobe Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (Adobe Advisory).