CVE-2024-26042: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26042. The vulnerability was discovered and reported by Adobe Systems Incorporated, with the initial disclosure date of March 18, 2024 (NVD).

The vulnerability is classified as a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) with a CVSS v3.1 base score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction, with a changed scope and low impact on confidentiality and integrity (Adobe Advisory).

If exploited, the vulnerability could allow an attacker to inject malicious scripts into vulnerable web pages. When a victim browses to the page containing the vulnerable script, malicious JavaScript may be executed in the context of the victim's browser, potentially leading to arbitrary code execution in the browser context (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, but does require user interaction. There are currently no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects versions 6.5.19 and earlier, and users should upgrade to version 6.5.20.0 or later (Adobe Advisory).