CVE-2024-36175: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-36175 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability was discovered and disclosed in May 2024, allowing attackers to inject malicious scripts into vulnerable form fields (Adobe Security, CVE Details).

The vulnerability is classified as a stored XSS vulnerability that affects form fields in Adobe Experience Manager. When successfully exploited, malicious JavaScript code can be executed in a victim's browser when they access the page containing the compromised field. The vulnerability has been assigned a CVSS score of 5.4, indicating moderate severity, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A (Adobe Security).

The successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who visit the affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (CIS Advisory).

The vulnerability requires an attacker to have access to form fields within the AEM system with sufficient privileges to input malicious content. There are currently no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Organizations are advised to update their Adobe Experience Manager installations to the latest version. The update should be applied after appropriate testing in accordance with organizational change management procedures (Adobe Security).