Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Root

Cause Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The flaw lies in insufficient sanitization of user-supplied input in form fields, allowing a low-privileged attacker to inject malicious JavaScript code that is stored and later executed in the browser of any victim viewing the affected page [1].

Attack

Vector Exploitation requires only low-privileged access to the Adobe Commerce instance, for example as a customer or administrative user with limited permissions. The attacker injects a malicious script into a vulnerable form field, which is then persisted on the server. When a victim—possibly another administrator or storefront user—navigates to the page containing that field, the script executes in their browser context with the origin and permissions of the legitimate application [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's session, leading to session takeover. This exposes both confidentiality and integrity impacts, as the attacker can perform actions on behalf of the victim, access sensitive data, and manipulate the application state [1].

Mitigation

Adobe has released security patches for affected versions: 2.4.4-p11, 2.4.5-p10, 2.4.6-p8, 2.4.7-p3 and later. Users should update to these patched versions immediately. The Magento Open Source codebase is available on GitHub for review [2]. No workarounds are documented; applying the latest patch is the recommended action.