CVE-2024-26071: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that was disclosed on June 13, 2024. The vulnerability has been assigned CVE-2024-26071 and received a CVSS v3.1 base score of 5.4 (Medium) (NVD, Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction for successful exploitation (NVD).

When successfully exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This can lead to potential information disclosure and integrity impacts, though the overall impact is considered moderate based on the CVSS score (Adobe Advisory).

The vulnerability requires an attacker to have low-level privileges and the ability to inject malicious scripts into form fields. Successful exploitation also depends on user interaction, as victims need to browse to the page containing the compromised field (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update to the latest version of Adobe Experience Manager to mitigate this security issue (Adobe Advisory).