CVE-2024-36142: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-36142 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.20 and earlier. The vulnerability was discovered and disclosed on June 13, 2024, and received a CVSS v3.1 base score of 5.4 (Medium severity) (NVD, Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (CWE-79) issue that allows attackers to inject malicious scripts into vulnerable form fields. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction for successful exploitation (NVD).

When exploited, the vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. This can lead to unauthorized access to sensitive browser-based information and potential manipulation of web content within the user's session (NVD).

The vulnerability requires low attack complexity and low privileges for exploitation. An attacker needs to have the ability to inject malicious scripts into form fields, and successful exploitation depends on a victim browsing to the affected page (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).