CVE-2024-26103: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26103. The vulnerability was discovered and disclosed on March 18, 2024, with Adobe Systems Incorporated serving as the assigning CNA (NVD, CVE).

The vulnerability is classified as a reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

If successfully exploited, this vulnerability allows an attacker to execute malicious JavaScript content within the context of the victim's browser when they visit a URL referencing a vulnerable page. This could potentially lead to unauthorized access to sensitive information and compromise of user sessions (Adobe Advisory).

The vulnerability requires user interaction for successful exploitation, as an attacker needs to convince a victim to visit a specifically crafted URL that references a vulnerable page. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has addressed this vulnerability in Experience Manager version 6.5.20.0 and later releases. Organizations are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).