Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing security features within the application. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-54252 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious script and inject it into a vulnerable form field. The attacker then needs to trick a user into visiting the page containing the vulnerable field, which will execute the injected script in the context of the user’s session. This can lead to unauthorized actions being performed on behalf of the user or sensitive information being disclosed.
Affected Products
- Adobe Experience Manager 6.5.23.0 and earlier: Vulnerable to stored XSS, allowing attackers to inject scripts into form fields.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager that addresses this issue. Additionally, implementing input validation and sanitization on form fields can help prevent the injection of malicious scripts.