Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23.0 and earlier. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields, potentially bypassing security features within the application. Exploitation requires user interaction, as a victim must visit the page containing the affected field.

Impact

Exploitation of this vulnerability could lead to a bypass of security features within the application.

Remediation

Users are advised to update to Adobe Experience Manager 6.5 LTS SP1 (Granite-61551 Hotfix) or version 6.5.23 (Granite-61551 Hotfix). For those on AEM Cloud Service, updates will be applied automatically. Instructions for downloading the update can be found in the release notes for AEM 6.5 LTS and AEM Cloud Service.