CVE-2024-26117: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26117. The vulnerability was disclosed and assigned a CVSS v3.1 base score of 5.4 (Medium) (Vendor Advisory).

The vulnerability is classified as a reflected Cross-Site Scripting (XSS) issue (CWE-79). It has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required privileges, user interaction, and potential for limited confidentiality and integrity impacts (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute malicious JavaScript content within the context of the victim's browser when the victim visits a specially crafted URL referencing a vulnerable page (Vendor Advisory).

The vulnerability requires an attacker to convince a victim to visit a URL that references a vulnerable page. The attack requires low complexity but does need user interaction and low-level privileges to execute (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (Vendor Advisory).