Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could inject malicious scripts into vulnerable form fields. This could lead to the execution of malicious JavaScript in a victim’s browser when they access the affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64614 |
Exploitation
To exploit this vulnerability, an attacker must find a vulnerable form field within Adobe Experience Manager. By injecting malicious scripts into these fields, the attacker can trick users into executing the scripts when they visit the page containing the vulnerable field. This requires the attacker to have low privileges and for the user to interact with the page.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to stored XSS attacks through form fields.
Mitigation
To mitigate this vulnerability, it is recommended to update Adobe Experience Manager to the latest version. Additionally, users should validate and sanitize input in form fields to prevent script injection. Regular security audits and monitoring can also help identify and remediate potential vulnerabilities.