Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. This vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim views the page containing the affected field, the injected JavaScript could be executed in their browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Remediation

Users are advised to update to Adobe Experience Manager version 6.5.23 or later. For those on AEM Cloud Service, updates will be applied automatically. Instructions for updating AEM can be found in the Adobe Experience Manager Release Notes.