CVE-2023-48619: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on December 15, 2023, and was assigned identifier CVE-2023-48619 (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79). It received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with a changed scope and low impact on confidentiality and integrity (Adobe Advisory).

When exploited, this vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the vulnerable field, the malicious JavaScript may be executed in their browser (NVD).

The vulnerability requires low privileges to exploit and can be accessed through the network. An attacker needs to have access to inject malicious scripts into form fields, and successful exploitation requires user interaction when browsing to the affected page (Adobe Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Experience Manager installations to versions newer than 6.5.18 (Adobe Advisory).