CVE-2024-53963
Published: 05 February 2025
Summary
CVE-2024-53963 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Experience Manager. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
Adobe Experience Manager versions 6.5.21 and earlier contain a DOM-based cross-site scripting vulnerability tracked as CVE-2024-53963. The flaw, classified under CWE-79, allows manipulation of a DOM element via crafted input or URL parameters, causing attacker-controlled scripts to execute in the context of a victim's browser session when the page renders.
A low-privileged attacker can trigger the issue by supplying malicious input that a victim subsequently accesses or interacts with. Successful exploitation yields arbitrary script execution with limited impact on confidentiality and integrity but no direct availability effect, as reflected in the CVSS 5.4 score requiring both low privileges and user interaction.
The Adobe advisory APSB24-69 at helpx.adobe.com/security/products/experience-manager/apsb24-69.html addresses the issue and is the primary source for remediation guidance. The associated EPSS score has remained flat at 0.0536 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52218
Vulnerability details
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute arbitrary code in the context of the victim's browser session. By manipulating a…
more
DOM element through a crafted URL or user input, the attacker can inject malicious scripts that run when the page is rendered. This type of attack requires user interaction, as the victim would need to access a manipulated link or input data into a vulnerable page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM-based XSS in public-facing AEM enables direct exploitation of the web app (T1190) with arbitrary JavaScript execution in victim browser (T1059.007) via crafted input/links.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 Flaw Remediation directly addresses this DOM-based XSS vulnerability by requiring identification, reporting, and patching of the flaw as detailed in Adobe's APSB24-69 bulletin.
SI-10 Information Input Validation prevents exploitation by checking and validating crafted URLs and user inputs to block malicious script injection.
SI-15 Information Output Filtering mitigates DOM-based XSS by encoding and filtering outputs to neutralize injected scripts when pages are rendered in the victim's browser.