Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim’s browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2025-64537 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious web page containing harmful scripts. The victim must then be tricked into visiting this page, which will execute the injected scripts in their browser context. This can lead to session hijacking and unauthorized access to sensitive information.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to DOM-based XSS allowing arbitrary code execution.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager. Additionally, implementing security best practices such as input validation and sanitization can help reduce the risk of XSS attacks.