CVE-2024-26084: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on April 10, 2024, and was assigned CVE-2024-26084. This security flaw affects Adobe Experience Manager installations up to version 6.5.19 (NVD Database).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD Database).

The vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to pages containing the compromised fields, malicious JavaScript may be executed within the context of their browsers (Adobe Advisory).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack vector is network-accessible, and the attack complexity is considered low according to the CVSS metrics (NVD Database).

Adobe has released security updates to address this vulnerability. Users should upgrade to versions newer than 6.5.19 to mitigate the risk (Adobe Advisory).