CVE-2024-36193: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-36193. The vulnerability was disclosed on May 21, 2024, and allows attackers to inject malicious scripts into vulnerable form fields (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A). The technical assessment indicates that the vulnerability requires network access, low attack complexity, and low privileges, but does require user interaction (Adobe Security).

When successfully exploited, the vulnerability allows malicious JavaScript execution in victims' browsers when they navigate to pages containing compromised form fields. This could potentially lead to unauthorized data access or manipulation within the context of the user's browser session (CVE Details).

The vulnerability requires an attacker to have access to form fields within the Adobe Experience Manager system. The attacker must be able to store malicious scripts in these fields, which are then executed when other users access the affected pages (Adobe Security).

Adobe has acknowledged the vulnerability and provided information through their security bulletin APSB24-28. Users are advised to update their Adobe Experience Manager installations to versions newer than 6.5.20 (Adobe Security).