CVE-2024-26125: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-26125. The vulnerability was discovered and disclosed in March 2024, with Adobe Systems Incorporated serving as the assigning CNA (CVE Details).

The vulnerability is a stored Cross-Site Scripting (XSS) issue that could be exploited by an attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the vulnerable field, the malicious JavaScript may be executed in their browser. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

If successfully exploited, this vulnerability could allow attackers to execute malicious JavaScript in victims' browsers when they visit pages containing compromised form fields. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (CIS Advisory).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has addressed this vulnerability in versions after 6.5.19. Organizations are advised to update to the latest version of Adobe Experience Manager. The fix is available through Adobe's security update (Adobe Advisory).