CVE-2024-26049: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26049. The vulnerability was discovered and disclosed on February 14, 2024, affecting Adobe Experience Manager's form field functionality (MITRE CVE, NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires high privileges to exploit and user interaction for successful execution. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows privileged attackers to inject malicious scripts into vulnerable form fields. The injected JavaScript code can be executed in a victim's browser when they access the page containing the compromised field (MITRE CVE).

The vulnerability requires high privileges for exploitation and user interaction, indicating that an attacker would need significant access to the system to successfully exploit it. The attack vector is network-based with low attack complexity (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).