Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Overview

CVE-2025-24417 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The root cause lies in insufficient sanitization of user-supplied input in form fields, allowing an attacker with low privileges to inject arbitrary JavaScript code that is stored on the server and later executed in the browsers of other users [1].

Exploitation

Conditions

An attacker must have a low-privileged account (e.g., a merchant or customer with limited permissions) to access the vulnerable form fields. No additional authentication or network position is required beyond standard web access. The injected script is triggered when a victim (such as an administrator or other user) navigates to the page containing the compromised field, leading to automatic execution of the malicious JavaScript in the victim's browser [1].

Impact

Successful exploitation enables the attacker to perform session takeover, effectively hijacking the victim's authenticated session. This can lead to unauthorized access to sensitive data and administrative functions, resulting in high confidentiality and integrity impact. The attacker could potentially modify store configurations, access customer data, or perform other actions under the victim's identity [1].

Mitigation

Status

As of the publication date (2025-02-11), Adobe has not released a security patch for this vulnerability. Users of the affected versions are advised to apply any available security updates from Adobe as soon as they are released, or to implement workarounds such as input validation and content security policies to reduce risk [1].