CVE-2024-20799: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.19 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-20799. This security flaw was discovered and disclosed to Adobe Systems Incorporated, with the initial CVE record being created on December 4, 2023 (CVE MITRE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that affects form fields within Adobe Experience Manager. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires low attack complexity but also requires low privileges and user interaction (NVD).

When exploited, this vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to pages containing these compromised fields, the malicious JavaScript code executes in their browsers, potentially leading to unauthorized data access or manipulation (Adobe Advisory).

The vulnerability requires an attacker to have access to form fields within the Adobe Experience Manager system. The attack vector is network-accessible (AV:N), and successful exploitation requires low complexity (AC:L) but does need low privileges (PR:L) and user interaction (UI:R) (NVD).

Adobe has addressed this vulnerability in Experience Manager version 6.5.20.0 and AEM Cloud Service version 2024.3.0. Users are advised to update to these or later versions to mitigate the risk (Adobe Advisory).