CVE-2024-26120: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26120. The vulnerability was discovered and disclosed by Adobe Systems Incorporated on March 18, 2024 (Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 base score is 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (Adobe Advisory).

When successfully exploited, malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. This could potentially lead to unauthorized access to user data or manipulation of the web interface (CIS Advisory).

The vulnerability requires low attack complexity and low privileges to exploit, though user interaction is required. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. The vulnerability affects both Adobe Experience Manager version 6.5.19.0 and earlier, as well as versions up to AEM Cloud Service 2024.3.0 (Adobe Advisory).