CVE-2024-20778: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. The vulnerability was disclosed on April 10, 2024, and was assigned CVE-2024-20778. This vulnerability affects Adobe Experience Manager 6.5.19 and earlier versions, as well as AEM Cloud Service (NVD, Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). According to the CVSS 3.1 scoring system, it has received a base score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with potential impacts on confidentiality and integrity (NVD).

When exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks (NVD).

The vulnerability requires network access and low attack complexity to exploit. An attacker needs low privileges and user interaction is required for successful exploitation. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. For AEM 6.5, users should upgrade to version 6.5.20.0 or later, and for AEM Cloud Service, users should upgrade to version 2024.3.0 or later (Adobe Advisory).