PT-2022-6430 · Adobe · Commerce

Published 2022-10-11 · Updated 2022-10-19 · CVE-2022-35698

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4-p1 and earlier Adobe Commerce versions 2.4.5 and earlier

Description The issue is related to a Stored Cross-site Scripting problem. It does not require user interaction to be exploited and could lead to post-authentication arbitrary code execution. The vulnerability exists due to inadequate protection of the web page structure, which could allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Commerce versions 2.4.4-p1 and earlier, update to a version that addresses this issue. For Adobe Commerce versions 2.4.5 and earlier, update to a version that addresses this issue. As a temporary workaround, consider restricting access to sensitive areas of the platform to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-01235

CVE-2022-35698

GHSA-4VJ2-426R-JM3G

Affected Products

Commerce

References · 7

• 🔥 https://github.com/EmicoEcommerce/Magento-APSB22-48-Security-Patches · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35698 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35698 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01235 · Security Note
• https://osv.dev/vulnerability/GHSA-4vj2-426r-jm3g · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb22-48.html · Vendor Advisory
• https://github.com/magento/magento2 · Note