Adobe Commerce Stored XSS Vulnerability Affects Multiple Versions

CVE-2024-39403

Summary

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9, and earlier are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This flaw allows attackers with low privileges to exploit vulnerable form fields by injecting malicious JavaScript, which can subsequently be executed in the browsers of users who access the compromised page. The potential impact includes the unauthorized exfiltration of sensitive information, posing serious confidentiality risks. Organizations using affected versions should take immediate steps to remediate this vulnerability.

References