This vulnerability (CVE-2024-29124) in AAM Advanced Access Manager allows an attacker with high privileges and requiring user interaction to inject and store malicious scripts due to improper input sanitization during web page generation. The flaw enables stored cross-site scripting (CWE-79), potentially impacting confidentiality, integrity, and availability to a limited extent. The affected versions include all releases up to 6.9.20. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit high-privilege access and exercise caution with user input handling in the affected plugin. Monitor vendor communications for updates regarding patches or mitigations.