Adobe Experience Manager DOM-Based Cross-Site Scripting Vulnerability

A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. This vulnerability allows a low-privileged attacker to manipulate the DOM environment and execute malicious JavaScript in the context of the victim's browser. Exploitation requires user interaction, as the victim must visit a specially crafted web page.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in the context of the user's browser.

Remediation

Users are advised to update to Adobe Experience Manager version 6.5.23 or to the latest release of AEM Cloud Service. Instructions for updating can be found in the release notes for AEM 6.5 and AEM Cloud Service.