Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim’s browser. Exploitation requires user interaction, as the victim must visit a specially crafted web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-46856 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious web page that, when visited by a user, manipulates the Document Object Model (DOM) to execute harmful JavaScript code in the user’s browser. This requires the attacker to lure the victim into clicking a link or visiting the page.
Affected Products
- Adobe Experience Manager 6.5.22 and earlier: A web content management solution that allows users to create, manage, and optimize customer experiences across various channels.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager. Additionally, implementing security best practices such as input validation and sanitization can help prevent XSS attacks.