CVE-2024-26030: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-26030 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.19 and earlier. The vulnerability was discovered and disclosed on March 18, 2024, and affects Adobe Experience Manager's form field functionality (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to user data, session hijacking, or other client-side attacks within the context of the affected web application (CIS Advisory).

The vulnerability requires low privilege access and user interaction for successful exploitation. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Organizations are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects both standard installations and AEM Cloud Service versions, with fixes available in version 6.5.20.0 and 2024.3.0 respectively (NVD).