Privilege escalation via attacker-controlled DOM JavaScript

DOM-based XSS in Adobe Experience Manager affected releases allows remote authenticated users to escalate privileges through a crafted webpage. Client-side code reads attacker-controlled data from the DOM environment and executes it as JavaScript in the victim's browser; Adobe has not disclosed the responsible component or source-to-sink path. Exploitation requires an authenticated attacker and a victim who visits the crafted webpage, confining execution to the victim's AEM browser context.