vulnwire
9.1crit

CVE-2024-20719

[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297

Also known as GHSA-264g-f7v8-q5qq

Published 2 y ago · modified 4 mo ago · JSON

CVSS
9.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
GitHub3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
packagistmagento/community-edition
1 listed versions
>=2.4.6-p1, <2.4.6-p4
>=2.4.5-p1, <2.4.5-p6
>=2.4.4-p1, <2.4.4-p7
2.4.6-p4
2.4.5-p6
2.4.4-p7
packagistmagento/project-community-edition
<=2.0.2
no fix listed

Affected products

  • Adobe Adobe Commerce
  • adobe commerce

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.