VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Aug 16, 2022· Updated Jun 17, 2026

CVE-2022-34258

CVE-2022-34258

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
magento/community-editionPackagist
>= 2.3.0, < 2.3.7-p42.3.7-p4
magento/community-editionPackagist
>= 2.4.4, < 2.4.52.4.5
magento/community-editionPackagist
>= 2.4.0, < 2.4.3-p32.4.3-p3

Affected products

21
  • Adobe Inc./Commerce9 versions
    cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*range: >=2.3.0,<2.3.7
    • cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
  • Magento/Magento9 versions
    cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*+ 8 more
    • cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*range: >=2.3.0,<2.3.7
    • cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*
  • osv-coords2 versions
    pkg:bitnami/magentopkg:composer/magento/community-edition
    >= 2.3.0, < 2.3.7+ 1 more
    • (no CPE)range: >= 2.3.0, < 2.3.7
    • (no CPE)range: >= 2.3.0, < 2.3.7-p4
  • Adobe Inc./Magento Commercecpe-rescue
    Range: unspecified

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.