PT-2024-6963 · Adobe · Magento Open Source+1

Published 2024-10-08 · Updated 2024-10-10 · CVE-2024-45123

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier Magento Open Source versions 2.4.7-p2 through 2.4.4-p10 and earlier

Description The issue is related to a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker convinces a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. This vulnerability is associated with the failure to protect the structure of web pages, which could allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier, update to a version that is not affected by this vulnerability. For Magento Open Source versions 2.4.7-p2 through 2.4.4-p10 and earlier, update to a version that is not affected by this vulnerability. As a temporary workaround, consider restricting access to vulnerable pages until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-08212

CVE-2024-45123

GHSA-88X2-CQ34-5FWC

Affected Products

Commerce

Magento Open Source

References · 9

• https://osv.dev/vulnerability/GHSA-88x2-cq34-5fwc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45123 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45123 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb24-73.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08212 · Security Note
• https://github.com/magento/magento2 · Note
• https://twitter.com/VulmonFeeds/status/1844382569812406570 · Twitter Post
• https://twitter.com/CVEnew/status/1844321323780284638 · Twitter Post
• https://t.me/cvedetector/7589 · Telegram Post