Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim’s browser. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64566 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or manipulate a web page that, when visited or interacted with by a user, executes the malicious script in the user’s browser. This requires the user to be tricked into clicking the link or engaging with the page, allowing the attacker to run scripts with the user’s privileges.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to XSS attacks that can execute scripts in the user’s browser.
Mitigation
To mitigate this vulnerability, users should avoid clicking on untrusted links and ensure they are using the latest version of Adobe Experience Manager. Adobe may also provide patches or updates to address this issue, so keeping software up to date is crucial.