CVE-2024-36177: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-36177. The vulnerability was disclosed on May 21, 2024, and allows attackers to inject malicious scripts into vulnerable form fields (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A). The technical assessment indicates that the vulnerability requires network access, low attack complexity, and low privileges, but does require user interaction (Adobe Security).

When exploited, the vulnerability allows malicious JavaScript execution in victims' browsers when they navigate to pages containing compromised form fields. This could potentially lead to unauthorized access to user data and compromise of user sessions (CVE Details).

The vulnerability requires an attacker to have access to form fields within Adobe Experience Manager where they can inject malicious scripts. The stored nature of the XSS makes it particularly concerning as the malicious payload persists on the server and can affect multiple users (Adobe Security).

Adobe has acknowledged the vulnerability and provided security updates through their security bulletin APSB24-28. Users are advised to update their Adobe Experience Manager installations to the latest version that includes patches for this vulnerability (Adobe Security).