CVE-2024-26097: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on April 10, 2024, and was assigned CVE-2024-26097. This security issue affects Adobe Experience Manager installations up to version 6.5.19 (NVD Database, CVE Database).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (NVD Database).

When exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This can lead to unauthorized access to user data, session hijacking, or other malicious activities within the context of the affected user's browser (Adobe Advisory).

The vulnerability requires low privileges and user interaction for successful exploitation. The attacker needs to inject malicious scripts into vulnerable form fields, which will then be stored and executed when other users access the affected pages (NVD Database).

Adobe has addressed this vulnerability in versions after 6.5.19. Users are advised to upgrade their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).