Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victims browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64565 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or manipulate a web page that, when visited or interacted with by a user, executes the malicious script in the context of the victims browser. This requires the user to be tricked into clicking the link or engaging with the page, allowing the attacker to run scripts that could compromise the user’s session or data.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to DOM-based XSS, requiring user interaction for exploitation.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager that addresses this issue. Additionally, users should be cautious when clicking on links or interacting with web pages from untrusted sources to avoid potential exploitation.