CVE-2024-26101: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on March 18, 2024, and was assigned CVE-2024-26101. This security issue affects Adobe Experience Manager installations up to version 6.5.19 and AEM Cloud Service versions prior to 2024.3.0 (NVD).

The vulnerability is classified as a reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (Medium). The attack requires network access, low attack complexity, low privileges, and user interaction. The vulnerability is characterized by CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, this vulnerability allows an attacker to execute malicious JavaScript content within the context of the victim's browser when they visit a specially crafted URL referencing a vulnerable page (Adobe Advisory).

The vulnerability requires an attacker to convince a victim to visit a URL referencing a vulnerable page. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) along with user interaction (UI:R) (NVD).

Adobe has released updates to address this vulnerability. Users should upgrade to Adobe Experience Manager version 6.5.20.0 or later, or for AEM Cloud Service users, update to version 2024.3.0 or later (NVD).