Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim’s browser. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64551 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or manipulate a web page that, when visited or interacted with by a user, executes the attacker’s scripts in the user’s browser context. This requires the user to be tricked into clicking the link or engaging with the page, allowing the attacker to perform actions on behalf of the user.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to XSS attacks that can lead to script execution in the user’s browser.
Mitigation
To mitigate this vulnerability, users should avoid clicking on untrusted links and ensure they are using the latest version of Adobe Experience Manager. Adobe has provided updates that address this issue, and users are encouraged to apply these updates promptly.