Adobe Experience Manager Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Adobe Experience Manager (AEM) versions 6.5.23 and earlier. This vulnerability allows low-privileged attackers to inject malicious scripts into form fields, which could then be executed in the browsers of users who view the affected page.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the user viewing the injected script.

Remediation

Users are advised to update to Adobe Experience Manager 6.5.24 or 6.5 LTS SP1 (Granite-61551 Hotfix). For AEM Cloud Service users, updates will be applied automatically.