CVE-2024-26064: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that was discovered and disclosed in March 2024. The vulnerability affects Adobe Experience Manager's web interface and has been assigned identifier CVE-2024-26064 (NVD).

The vulnerability is classified as a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to inject malicious scripts into a webpage. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity, requiring low privileges and user interaction (Adobe Advisory).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the victim's browser when they browse to a page containing the vulnerable script. The impact is limited to low confidentiality and integrity breaches, with no impact on availability (NVD).

Exploitation of this vulnerability requires user interaction and low privileges. The attacker needs to be able to inject malicious scripts into a webpage that the victim then visits (CIS Advisory).

Adobe has addressed this vulnerability in Experience Manager version 6.5.20.0 and AEM Cloud Service version 2024.3.0. Users are advised to update to these versions or later to mitigate the vulnerability (NVD).