CVE-2024-26073: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26073. The vulnerability was discovered and disclosed in March 2024, with Adobe Systems Incorporated being the assigning CNA (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that could allow an attacker to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to user data and compromise of user sessions (Adobe Advisory).

The vulnerability requires low attack complexity and low privileges for exploitation, though user interaction is required. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released version 6.5.20.0 to address this vulnerability. Organizations are advised to update their Adobe Experience Manager installations to the latest version immediately after appropriate testing (Adobe Advisory).