Stored Cross-Site Scripting Vulnerability in Adobe Commerce by Adobe
CVE-2025-24438

8.7HIGH

Key Information:

Vendor
Adobe
Vendor
CVE Published:
11 February 2025

Summary

Adobe Commerce is susceptible to a stored Cross-Site Scripting (XSS) vulnerability that allows low-privileged attackers to inject harmful scripts into susceptible form fields. When users visit a page containing the compromised field, malicious JavaScript may execute in their browsers, leading to potential session hijacking and undermining the integrity and confidentiality of user data. This vulnerability emphasizes the necessity for prompt updates and robust security practices to protect against such exploits.

Affected Version(s)

Adobe Commerce 0 <= 2.4.8-beta1

References

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.