Adobe Experience Manager DOM-Based Cross-Site Scripting Vulnerability Allowing Arbitrary Code Execution

A DOM-based Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23 and earlier. This vulnerability could lead to arbitrary code execution. An attacker can exploit this issue by injecting malicious scripts into a web page, which are then executed in the context of the victim's browser. Successful exploitation could result in session takeover. The vulnerability requires user interaction, as the victim must visit a crafted malicious page.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution, with potential for session takeover.

Remediation

Users are advised to update to Adobe Experience Manager 6.5.24 or 6.5 LTS SP1 (Granite-61551 Hotfix). For AEM Cloud Service users, updates will be applied automatically. Instructions for downloading these versions are available in the Adobe Experience Manager release notes.