Adobe Experience Manager XSS

Adobe Experience Manager (AEM) is a web content management system used by organizations to manage and publish their digital assets. This vulnerability allows attackers to execute malicious scripts in the context of a victim's browser through a DOM-based Cross-Site Scripting (XSS) attack, potentially leading to unauthorized access to sensitive data.

Affected versions: 6.5.23 If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to Adobe Experience Manager 6.5.24 or later. You can download the latest version from the Adobe Experience Manager website.

Immediate mitigations:

• Restrict network access to your AEM instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• Vendor Advisory