Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Details

CVE-2025-24415 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier [1]. The root cause lies in insufficient sanitization of user-supplied input within form fields, allowing an attacker to inject arbitrary JavaScript code that is stored on the server and later served to other users [1][2].

Attack

Vector

An attacker must have low-privileged access to the Adobe Commerce instance (e.g., a merchant or customer account with basic permissions) to craft and submit malicious payloads via vulnerable input fields [1]. No special network position is required beyond standard HTTP access. The attack does not require user interaction beyond browsing to the affected page, which triggers the stored JavaScript in the victim's browser [1].

Impact

Successful exploitation leads to execution of attacker-controlled JavaScript in the context of the victim's session. This allows the attacker to steal session cookies or tokens, resulting in session takeover [1]. According to the advisory, this compromises both confidentiality and integrity with high severity, as an attacker could impersonate the victim and perform unauthorized actions [1].

Mitigation

Adobe has released security patches for the affected versions: 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and the beta channel. Users are advised to update to the latest patched versions, as there are no practical workarounds. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog as of publication.