CVE-2024-26067: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26067. The vulnerability was discovered and disclosed by Adobe Systems Incorporated, with the initial CVE record being created on February 14, 2024 (CVE Mitre).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that could be exploited by injecting malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required privileges, and user interaction (Adobe Advisory).

When successfully exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to sensitive browser-based information and compromise of user sessions (CIS Advisory).

The vulnerability requires an attacker to have low-level privileges and user interaction for successful exploitation. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released software updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects versions 6.5.19 and earlier, and users should upgrade to version 6.5.20.0 or later (Adobe Advisory).