Magento Commerce Stored Cross-site Scripting Vulnerability

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by a stored cross-site scripting (XSS) vulnerability in the customer address upload feature. The vulnerability allows an attacker to inject malicious scripts into vulnerable form fields, which are then stored and executed when a victim views the page containing the field. [1]

Exploitation

An attacker with the ability to upload a customer address (e.g., a registered user) can inject malicious JavaScript into the address fields. The injected script is stored on the server and executed in the browser of any victim who navigates to the page displaying the vulnerable field. No additional user interaction beyond viewing the page is required. [1]

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the victim's browser within the context of the Magento application. This can lead to session hijacking, defacement, theft of sensitive data, or other actions that the victim's browser can perform. [1]

Mitigation

No fixed version is disclosed in the available references. Users should monitor Adobe's security advisories for patches. As of the publication date, no workaround is mentioned. [1]