Listen to this Post
How the CVE Works
CVE-2025-47020 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient input sanitization in form fields, allowing low-privileged attackers to inject malicious JavaScript payloads. When a victim accesses a compromised page, the stored script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions within the application. The attack leverages AEM’s content persistence mechanism, where tainted input is saved and later rendered without proper encoding.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Check vulnerable AEM version curl -I http://target/aem/version Exploit PoC (sanitized) POST /content/forms/af/injectable-field HTTP/1.1 Payload: <script>alert(document.cookie)</script>
How Exploit
1. Attacker submits malicious script via vulnerable form.
2. Payload persists in AEM storage.
3. Victim loads page, script executes.
Protection from this CVE
- Update to AEM 6.5.23+.
- Implement CSP headers.
- Sanitize user input.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
