CVE-2025-47084: Adobe Experience Manager XSS Vulnerability

CVE-2025-47084 Overview

CVE-2025-47084 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier, including AEM Cloud Service. A low-privileged authenticated attacker can inject malicious JavaScript into vulnerable form fields. The payload executes in a victim's browser when the victim views the page containing the injected content. Successful exploitation requires user interaction and can lead to session compromise within the victim's browser context. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers with low privileges can persist malicious scripts in AEM form fields, executing arbitrary JavaScript in the browsers of authenticated users who visit affected pages.

Affected Products

• Adobe Experience Manager 6.5.22 and earlier (on-premises)
• Adobe Experience Manager Cloud Service (affected releases)
• AEM form components accepting user-controlled input

Discovery Timeline

• 2025-06-10 - CVE-2025-47084 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47084

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Experience Manager form handling. AEM fails to properly neutralize user-supplied input before persisting it to backend storage and rendering it back to page visitors. An attacker with authoring or contributor-level access submits crafted input containing HTML or JavaScript into a vulnerable form field. The malicious payload is stored server-side and served to subsequent visitors of the affected page. When the page renders, the browser executes the attacker-controlled script in the origin of the AEM site.

Exploitation requires low privileges and user interaction. The vulnerability has scope change, meaning script execution affects resources beyond the initially vulnerable component, such as authenticated sessions in the AEM admin console. The EPSS score is 0.262%.

Root Cause

The root cause is missing or insufficient output encoding on form field values rendered in AEM-generated pages. Input passed through the affected form components is stored without sanitization and later inserted into the HTML response without contextual escaping. This allows an attacker to break out of the intended data context and inject executable script tags or event handlers.

Attack Vector

The attack path is network-based and requires authentication. An attacker with a low-privileged AEM account submits a crafted payload, such as <script> blocks or event handler attributes, into a vulnerable form field. The payload is stored and later rendered to any user who browses to the affected page. The victim's browser executes the script, enabling session token theft, credential harvesting through fake login prompts, or actions performed as the victim within AEM. See the Adobe Security Update APSB25-48 for technical details.

Detection Methods for CVE-2025-47084

Indicators of Compromise

• Form field values in AEM content repositories containing <script> tags, javascript: URIs, or DOM event handlers such as onerror, onload, or onmouseover
• Unexpected outbound HTTP requests from authenticated user sessions to attacker-controlled domains referrers matching AEM page URLs
• Anomalous form submissions from low-privileged AEM authoring accounts containing HTML markup or encoded script payloads

Detection Strategies

• Audit AEM content repository (JCR) nodes for stored HTML or script content within form-related properties
• Enable and review AEM Dispatcher and request logs for POST payloads containing script indicators or common XSS obfuscation patterns
• Correlate authoring activity from low-privileged accounts with subsequent anomalous JavaScript execution reported by browser telemetry

Monitoring Recommendations

• Deploy a web application firewall in front of AEM authoring and publish tiers with rules covering CWE-79 payload patterns
• Monitor Content Security Policy (CSP) violation reports for inline script execution on AEM-served pages
• Track privilege changes and content modification events for AEM authoring accounts through centralized log aggregation

How to Mitigate CVE-2025-47084

Immediate Actions Required

• Apply the Adobe security update referenced in APSB25-48 to AEM 6.5 and validate Cloud Service instances are on a patched release
• Review existing form field content in the JCR repository for stored script payloads and remove any malicious entries
• Rotate session tokens and credentials for accounts that may have viewed affected pages during the exposure window

Patch Information

Adobe published fixes in security bulletin APSB25-48. Administrators of on-premises AEM 6.5 should upgrade beyond version 6.5.22. AEM Cloud Service customers should confirm their environment is running the patched release from Adobe.

Workarounds

• Restrict authoring and form submission privileges to the minimum required set of trusted users
• Enforce a strict Content Security Policy on AEM publish instances to block inline script execution
• Configure the AEM Dispatcher to filter request payloads containing HTML or script markup where not required by business logic

# Example CSP header enforced via AEM Dispatcher or reverse proxy
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"