Vulnerability · Published Aug 16, 2022 · Assigned by adobe
CVE-2022-34258Adobe Commerce Stored XSS Arbitrary code execution
Medium 4.8
In plain English
A medium-severity cross-site scripting in Magento Commerce from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.9% (higher than 99.4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | magento/community-edition | 2.3.7-p4 | GHSA-5m55-g8pv-x8ww |
| Packagist | magento/community-edition | 2.4.5 | GHSA-5m55-g8pv-x8ww |
| Packagist | magento/community-edition | 2.4.3-p3 | GHSA-5m55-g8pv-x8ww |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Magento Commerce | unspecified – through 2.4.4unspecified – through 2.3.7-p3unspecified – through 2.4.3-p2unspecified – through None |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N