Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim’s browser. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64544 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or manipulate a web page that, when visited or interacted with by a user, executes the malicious script in the user’s browser. This requires the user to be tricked into performing the action, making user interaction a critical component of the exploitation process.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to DOM-based XSS, allowing execution of malicious scripts.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager. Additionally, users should be cautious when clicking on links or interacting with web pages from untrusted sources to avoid potential exploitation.