CVE-2024-36167: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-36167 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability was disclosed in June 2024 and received a CVSS v3.1 score of 5.4 (Medium severity) (Adobe Security, NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS v3.1 base score of 5.4 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction (Adobe Security).

If successfully exploited, this vulnerability could allow an attacker to inject malicious scripts into vulnerable Adobe Experience Manager instances. The impact is considered important as it could lead to arbitrary code execution in the context of the logged-on user (CIS Security).

Currently, there are no reports of this vulnerability being exploited in the wild (CIS Security).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Experience Manager. Organizations should apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing (CIS Security).