CVE-2024-52828: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-52828 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.21 and earlier. The vulnerability was disclosed on December 10, 2024, and impacts both AEM Cloud Service and on-premise installations (NVD, Adobe Advisory).

The vulnerability is classified as a stored XSS issue that allows attackers to inject malicious scripts into vulnerable form fields. When a victim browses to a page containing the compromised field, the malicious JavaScript code may be executed in their browser. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, and required user interaction (NVD).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in victims' browsers when they visit affected pages. This could lead to theft of sensitive information, session hijacking, or other client-side attacks within the context of the affected Adobe Experience Manager installation (NVD).

Adobe has addressed this vulnerability in Experience Manager versions after 6.5.21. Organizations are advised to upgrade to the latest version to mitigate this security risk (Adobe Advisory).