CVE-2024-36173: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was assigned CVE-2024-36173 and was publicly disclosed on May 21, 2024 (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) with a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A). The vulnerability allows attackers to inject malicious scripts into vulnerable form fields within the Adobe Experience Manager system (Adobe Security).

When exploited, this vulnerability enables malicious JavaScript execution in victims' browsers when they navigate to pages containing the compromised form fields. This could potentially lead to unauthorized access to user data and manipulation of web content (Adobe Security).

The vulnerability requires an attacker to have some level of privileges (PR:L) and user interaction (UI:R) for successful exploitation. The attack can be initiated from the network (AV:N) with low attack complexity (AC:L) (Adobe Security).