CVE-2023-48623: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2023-48623. The vulnerability was discovered and disclosed on December 15, 2023. This security issue affects Adobe Experience Manager's web interface and its cloud service configurations (NVD).

The vulnerability is classified as a reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

If successfully exploited, this vulnerability allows a low-privileged attacker to execute malicious JavaScript content within the context of the victim's browser when they visit a specially crafted URL referencing a vulnerable page (NVD).

The vulnerability requires a low-privileged attacker to convince a victim to visit a URL referencing a vulnerable page. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) along with user interaction (UI:R) (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager beyond version 6.5.18 (Adobe Security).