CVE-2024-26088: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability. This security flaw was assigned CVE-2024-26088 and was disclosed in 2024. The vulnerability affects Adobe Experience Manager installations, including both on-premises deployments up to version 6.5.20 and AEM Cloud Service versions prior to 2024.5 (Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The severity is rated as MEDIUM with a CVSS v3.1 base score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). This scoring indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction for successful exploitation (NVD).

When exploited, the vulnerability allows malicious JavaScript code to be executed in a victim's browser when they browse to a page containing the compromised field. This can lead to potential data theft, session hijacking, or other client-side attacks within the context of the affected AEM instance (Adobe Advisory).

The vulnerability requires an attacker to have low-level privileges to inject malicious scripts into form fields, and requires user interaction (visiting the affected page) for successful exploitation. The attack can be performed remotely over the network (NVD).

Adobe has addressed this vulnerability by releasing updated versions of the software. Users should upgrade to Adobe Experience Manager version 6.5.21 or later for on-premises deployments, or ensure their AEM Cloud Service is updated to version 2024.5 or later (Adobe Advisory).