CVE-2024-36195: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.20 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-36195. The vulnerability was disclosed on May 21, 2024, and allows attackers to inject malicious scripts into vulnerable form fields (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A). The technical assessment indicates that the vulnerability requires network access, low attack complexity, and low privileges, but does require user interaction (Adobe Security).

When exploited, this vulnerability allows malicious JavaScript execution in victims' browsers when they navigate to pages containing compromised form fields. This can lead to arbitrary code execution within the context of the affected user's browser session (Adobe Security).

The vulnerability requires an attacker to have access to form fields within Adobe Experience Manager where they can store malicious scripts. These scripts are then executed when other users access the affected pages (CVE Details).