Stored XSS in Adobe Commerce Form Fields Allows Script Injection

Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) issue affecting certain versions of Adobe Commerce. It allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. These scripts are then stored and can be executed when a user visits the affected page containing the malicious input.

Exploitation requires user interaction, meaning a victim must browse to the page with the vulnerable form field for the malicious script to execute.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of malicious scripts in the context of the affected website, potentially allowing attackers to steal sensitive information, hijack user sessions, or perform actions on behalf of the victim user.

Since exploitation requires a high-privileged attacker and user interaction, the risk is somewhat mitigated but still significant, especially in environments where sensitive data or administrative functions are accessible.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability affects Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier. To mitigate this stored Cross-Site Scripting (XSS) vulnerability, you should update Adobe Commerce to a version later than those listed that includes the security fix.

Additionally, since exploitation requires user interaction by browsing to a vulnerable page, consider restricting access to administrative or high-privilege user interfaces and educating users about the risks of interacting with untrusted content.

Useful 0 Not Useful 0