CVE-2025-47015 Overview
Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when they load the page containing the affected field. The flaw affects both on-premise AEM 6.5.x deployments and AEM Cloud Service instances. Adobe published the fix in Security Advisory APSB25-48.
Critical Impact
An authenticated attacker with low privileges can persist malicious JavaScript into AEM content, hijack authenticated sessions of other users, and pivot to author or administrator accounts through the victim's browser context.
Affected Products
- Adobe Experience Manager 6.5.22 and earlier (on-premise)
- Adobe Experience Manager Cloud Service (AEM as a Cloud Service)
- AEM Forms component (vulnerable form field rendering)
Discovery Timeline
- 2025-06-10 - CVE-2025-47015 published to the National Vulnerability Database
- 2025-06-10 - Adobe releases security patch via advisory APSB25-48
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47015
Vulnerability Analysis
The vulnerability is a stored (persistent) Cross-Site Scripting flaw in form field handling within Adobe Experience Manager. Content submitted by a low-privileged authenticated user is stored server-side without sufficient neutralization of HTML and JavaScript control characters. When another user loads the page containing the tainted field, the browser parses the attacker-controlled markup and executes the embedded script in the victim's origin.
The issue carries a scope change, meaning script execution crosses the trust boundary between the low-privileged content editor and higher-privileged users who consume the rendered page. Exploitation requires user interaction, typically a victim navigating to the affected AEM page. Impact is bounded to confidentiality and integrity of data reachable from the victim's browser session.
Root Cause
The root cause is improper neutralization of input during web page generation, mapped to [CWE-79]. AEM's form field rendering pipeline fails to encode user-supplied values before writing them into the HTML response. Special characters such as <, >, ", and ' are emitted verbatim, allowing an attacker to close attribute contexts and inject <script> blocks or event handlers like onerror and onload.
Attack Vector
An attacker requires a low-privileged AEM account with permission to edit or create form content. The attacker submits a form field value containing an XSS payload, which AEM stores in the JCR repository. When any authorized user, including authors or administrators, browses to the page rendering that field, the payload executes. Consequences include session token theft, unauthorized content modification through the victim's session, and CSRF-style operations against AEM administrative endpoints.
No verified public proof-of-concept code is available for this vulnerability. See the Adobe Security Advisory APSB25-48 for vendor-provided technical details.
Detection Methods for CVE-2025-47015
Indicators of Compromise
- Form field values in the JCR repository containing <script> tags, javascript: URIs, or DOM event handlers such as onerror=, onload=, or onmouseover=.
- Outbound HTTP requests from author or publish instances to unknown domains, consistent with beaconing from injected JavaScript.
- Unexpected AEM session activity, including administrative actions originating from author accounts shortly after browsing content pages.
Detection Strategies
- Audit AEM content nodes for stored input containing HTML tags or JavaScript syntax in fields that should hold plain text.
- Deploy a Web Application Firewall (WAF) rule set to flag XSS patterns in AEM form submissions and page responses.
- Enable Content Security Policy (CSP) reporting to capture inline script violations and identify pages rendering untrusted markup.
Monitoring Recommendations
- Forward AEM dispatcher and access logs to a centralized data lake and alert on anomalous script content in POST bodies to /content/ and /bin/ endpoints.
- Monitor author instance session activity for privilege-inconsistent actions following page views.
- Track Adobe security advisory feeds to correlate new AEM CVEs with in-environment version inventory.
How to Mitigate CVE-2025-47015
Immediate Actions Required
- Upgrade Adobe Experience Manager to the fixed version documented in Adobe Security Advisory APSB25-48.
- Review recent form submissions and content changes made by low-privileged accounts for injected script payloads.
- Rotate authentication tokens and session cookies for author and administrator accounts that may have browsed attacker-controlled content.
Patch Information
Adobe released fixes for on-premise AEM 6.5.x and AEM Cloud Service. Full remediation details are available in Adobe Security Advisory APSB25-48. AEM Cloud Service customers receive the fix through the standard release channel; on-premise customers must install the corresponding service pack.
Workarounds
- Restrict form authoring and content submission privileges to trusted users until patching is complete.
- Enforce a strict Content Security Policy on AEM-delivered pages to block inline script execution.
- Configure the AEM dispatcher to filter suspicious characters and script patterns in form submissions.
# Example Content Security Policy header for AEM dispatcher
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
