CVE-2024-53960: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2024-53960 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager versions 6.5.21 and earlier. The vulnerability was discovered and disclosed on December 10, 2024, impacting both the standard AEM installations and AEM Cloud Service deployments (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to pages containing the compromised fields, the malicious JavaScript executes in their browser context. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in victims' browsers when they visit affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks within the context of the affected Adobe Experience Manager installation (CIS Advisory).

Adobe has addressed this vulnerability in versions after 6.5.21 for standard installations and in version 2024.11.0 for AEM Cloud Service. Organizations are advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (NVD).