Stored cross-site scripting in Adobe Commerce (formerly Magento Commerce) and Magento Open Source - CVE-2024-39400

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU95948

Stored cross-site scripting in Adobe Commerce (formerly Magento Commerce) and Magento Open Source - CVE-2024-39400

Published: August 14, 2024


Vulnerability identifier: #VU95948
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-39400
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.



Affected software

Adobe Commerce (formerly Magento Commerce)
Magento Open Source

How to mitigate CVE-2024-39400

Install updates from vendor's website.

Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
Magento Open Source - addressed in versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2

External References

Related Security Bulletins