CVE-2025-47029: Adobe Experience Manager XSS Vulnerability

CVE-2025-47029 Overview

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability [CWE-79]. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The script executes in a victim's browser when they view the page containing the compromised field. Adobe published the fix in security bulletin APSB25-48.

The flaw affects both on-premises AEM 6.5.x deployments and AEM Cloud Service instances. Exploitation requires user interaction and low privileges, but the scope is changed, meaning the injected script can affect resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can persist malicious JavaScript in form fields, enabling session hijacking, credential theft, and unauthorized actions in the context of any user who renders the affected page.

Affected Products

Adobe Experience Manager 6.5.22 and earlier (on-premises)
Adobe Experience Manager Cloud Service
AEM Forms components handling user-supplied field data

Discovery Timeline

2025-06-10 - CVE-2025-47029 published to NVD
2025-06-10 - Adobe releases security bulletin APSB25-48
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47029

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form-field handling. AEM fails to properly sanitize or encode attacker-controlled input before persisting it to the content repository and rendering it back to users. Because the payload is stored server-side, every subsequent visitor to the affected page triggers execution of the attacker's JavaScript.

Exploitation requires an authenticated account with permission to edit form content, but the required privilege level is low. The changed-scope characteristic reflects the ability of injected scripts to affect authentication contexts, cookies, and DOM elements outside the immediate vulnerable component. Victims must load or interact with the affected page to trigger the payload.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. AEM's form-field processing path accepts script-bearing input without applying output encoding suitable for the HTML rendering context. Standard defenses such as HTML entity encoding, attribute-context escaping, or Content Security Policy enforcement were insufficient in the vulnerable code path.

Attack Vector

An authenticated attacker with content-authoring privileges submits crafted input containing JavaScript into a vulnerable form field. AEM stores the payload in the Java Content Repository (JCR). When any user, including higher-privileged administrators, browses to the page rendering that field, the browser parses and executes the injected script. The attacker can steal session cookies, perform CSRF-style actions, deface content, or pivot to further compromise of the AEM author or publish tier.

See the Adobe Security Update APSB25-48 for vendor technical details.

Detection Methods for CVE-2025-47029

Indicators of Compromise

Form field values containing <script>, javascript:, or event-handler attributes such as onerror=, onload=, onmouseover=
Unexpected outbound requests from author or publish nodes to attacker-controlled domains during page rendering
Audit log entries showing form-field edits by low-privileged accounts followed by administrator page views
HTML entities or encoded script payloads (for example <script>) stored in JCR nodes

Detection Strategies

Query the JCR for form-field properties matching XSS payload patterns using AEM's Query Builder or JCR-SQL2
Enable and review AEM Dispatcher logs for anomalous POST requests to /content/forms/ paths
Inspect stored properties on cq:PageContent and form nodes for HTML or JavaScript syntax where plain text is expected
Correlate content-modification events with subsequent client-side errors or Content Security Policy violation reports

Monitoring Recommendations

Deploy Content Security Policy (CSP) headers in report-only mode to surface unexpected inline script execution
Monitor AEM access.log and error.log for repeated form submissions from a single authenticated session
Track privileged-user page views immediately following content edits by low-privileged authors
Alert on JCR write operations that include HTML tags in properties historically containing plain text

How to Mitigate CVE-2025-47029

Immediate Actions Required

Upgrade AEM 6.5.x installations to version 6.5.23 or later per bulletin APSB25-48
Apply the current AEM Cloud Service release, which addresses the vulnerability
Audit form-field content authored since the vulnerable release for injected script content
Rotate session tokens and administrator credentials if suspicious content modifications are found

Patch Information

Adobe addressed CVE-2025-47029 in the June 2025 security update. Refer to the Adobe Security Update APSB25-48 for supported patched versions and installation guidance for both on-premises AEM 6.5 and AEM Cloud Service.

Workarounds

Restrict content-authoring permissions to trusted accounts and enforce least privilege on form-editing roles
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Configure AEM Dispatcher filters to block requests containing suspicious payload patterns in form parameters
Enable multi-factor authentication for all AEM author-tier accounts to reduce risk from compromised credentials

bash

# Example Dispatcher filter to block script tags in form submissions
/0100 { /type "deny" /method "POST" /url "*<script*" }
/0101 { /type "deny" /method "POST" /url "*javascript:*" }

# Example CSP header configuration in AEM Dispatcher vhost
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"