CVE-2024-36144: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on June 13, 2024, and was assigned identifier CVE-2024-36144. This security issue affects the form field functionality in AEM installations (Adobe Advisory).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The vulnerability has received a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires network access, low attack complexity, low privileges, and user interaction (NVD).

When successfully exploited, the vulnerability allows malicious JavaScript code to be executed in a victim's browser when they browse to the page containing the vulnerable field. This can lead to potential compromise of user data and browser-based attacks (Adobe Advisory).

The vulnerability requires an attacker to have low-level privileges to inject malicious scripts into form fields. User interaction is required as the victim needs to browse to the page containing the compromised field for the exploit to be successful (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).