Stored cross-site scripting in Magento Open Source and Adobe Commerce (formerly Magento Commerce) - CVE-2023-29297
Published: June 16, 2023
Vulnerability identifier: #VU77469
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2023-29297
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote administrator to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote administrator can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Affected software
Magento Open Source
Adobe Commerce (formerly Magento Commerce)
Adobe Commerce (formerly Magento Commerce)
How to mitigate CVE-2023-29297
Install updates from vendor's website.
Magento Open Source - addressed in versions 2.4.4-p4, 2.4.5-p3, 2.4.6-p1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-3, 2.4.0-ext-3, 2.4.1-ext-3, 2.4.2-ext-3, 2.4.3-ext-3, 2.4.4-p4, 2.4.5-p3, 2.4.6-p1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-3, 2.4.0-ext-3, 2.4.1-ext-3, 2.4.2-ext-3, 2.4.3-ext-3, 2.4.4-p4, 2.4.5-p3, 2.4.6-p1