PT-2024-6008 · Adobe · Commerce
Published
2024-08-13
·
Updated
2024-08-14
·
CVE-2024-39403
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Commerce versions 2.4.7-p1 through 2.4.4-p9 and earlier
Description
The issue is related to insufficient protection of the web page structure, which could allow a remote attacker to execute arbitrary code. A stored Cross-Site Scripting (XSS) vulnerability is present, allowing a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to the page containing the vulnerable field, malicious JavaScript may be executed in their browser, potentially leading to high confidentiality impact due to the attacker being able to exfiltrate sensitive information.
Recommendations
For Adobe Commerce versions 2.4.7-p1 through 2.4.4-p9 and earlier, consider disabling vulnerable form fields until a patch is available to prevent malicious script injection.
Restrict access to vulnerable pages to minimize the risk of exploitation.
Avoid using vulnerable form fields in the affected Adobe Commerce versions until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Commerce