CVE-2024-36149: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-36149 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.20 and earlier. The vulnerability was discovered and disclosed on June 13, 2024, and was assigned by Adobe Systems Incorporated (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows attackers to inject malicious scripts into vulnerable form fields. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows malicious JavaScript to be executed in a victim's browser when they browse to the page containing the vulnerable field. The impact is considered medium severity, with potential for information disclosure and limited integrity compromise (NVD).

The vulnerability requires low attack complexity but needs low privileges and user interaction for successful exploitation. The attack vector is network-accessible, making it possible to exploit remotely (NVD).

Adobe has addressed this vulnerability in versions after 6.5.20. Organizations are advised to upgrade their Adobe Experience Manager installations to the latest version to mitigate this security risk (Adobe Advisory).