Listen to this Post
How the CVE Works
CVE-2025-47017 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient input sanitization in form fields, allowing a low-privileged attacker to inject malicious JavaScript. When a victim accesses a compromised page, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions. The attack is stored, meaning the payload persists on the server until manually removed.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Analytics:
curl -X GET "https://api.adobe.com/aem/check" -H "Authorization: Bearer <token>"
document.getElementById('vuln-field').innerHTML = unescape(payload);
Exploit:
- Craft malicious JS payload.
- Inject via vulnerable form.
- Trigger on page load.
Protection from this CVE:
- Sanitize form inputs.
- Apply CSP headers.
- Update to patched version.
Impact:
- Session hijacking.
- Data exfiltration.
- Unauthorized actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
