Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Overview

A stored Cross-Site Scripting (XSS) vulnerability exists in Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13, and earlier [1]. The root cause lies in insufficient sanitization of input in vulnerable form fields, allowing a high-privileged attacker to inject persistent malicious scripts [1].

Exploitation

Prerequisites and Attack Surface

Exploitation requires an authenticated attacker with high privileges (e.g., admin or similar role) within the Adobe Commerce backend [1]. The attacker injects the malicious payload into a form field that is subsequently rendered to other high-privileged users [1]. The attack does not require social engineering beyond standard administrative actions.

Impact

When a victim with high privileges browses to the affected page, the injected JavaScript executes in their browser [1]. This can lead to unauthorized data access, modification of configurations, or further compromise of the application, with high impact on confidentiality, integrity, and availability [1]. The scope change indicates the attack can affect resources beyond the initial vulnerable component.

Mitigation and

Status

Adobe has likely released security patches addressing this vulnerability; users should upgrade to the latest supported versions of Adobe Commerce [1][2]. The official product repository (Magento Open Source) may contain fix references [2]. As of publication, this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.