CVE-2020-24445: XSS in Adobe Experience Manager

Successful exploitation of CVE-2020-24445 allows an attacker to inject arbitrary JavaScript code into AEM pages. When a user visits a page containing the injected script, the malicious code will execute within their browser context. This could lead to various attacks, including session hijacking, credential theft, defacement of the website, and redirection to malicious sites. The impact is particularly severe because XSS vulnerabilities can be exploited without requiring authentication, potentially affecting all users of the affected AEM instance. The stored nature of the XSS means the injected script persists until removed, allowing for repeated exploitation.

1. Reserved2020-08-19
2. Published2020-12-10
3. Modified2024-09-17
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-24445 is to upgrade to a patched version of Adobe Experience Manager. Adobe recommends upgrading to a version that includes the fix for this vulnerability. If immediate upgrade is not possible, consider implementing input validation and output encoding on all user-supplied data to prevent malicious scripts from being injected. Web Application Firewalls (WAFs) configured to detect and block XSS attacks can also provide a temporary layer of protection. Carefully review and sanitize all form fields and user input within AEM.