Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim’s browser. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-64888 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL or manipulate a web page that, when visited or interacted with by a user, executes the attacker’s scripts in the user’s browser context. This requires the user to be tricked into clicking the link or engaging with the page, allowing the attacker to run arbitrary scripts.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to DOM-based XSS, requiring user interaction for exploitation.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager. Additionally, users should avoid clicking on untrusted links and be cautious when interacting with web pages that seem suspicious.