Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) Screens) versions through 11.6. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim interacts with the page containing the compromised field, the injected JavaScript could be executed in their browser. Exploitation of this vulnerability requires user interaction, as the victim must open a malicious link.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution in the context of the victim's browser.

Remediation

Users are advised to update to Adobe Experience Manager (AEM) Screens version 6.5.22 Screens FP11.7. Release notes for this version are available on the Adobe Experience League website.