Stored cross-site scripting in Adobe Commerce (formerly Magento Commerce) and Magento Open Source - CVE-2024-39403

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU95949

Stored cross-site scripting in Adobe Commerce (formerly Magento Commerce) and Magento Open Source - CVE-2024-39403

Published: August 14, 2024


Vulnerability identifier: #VU95949
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-39403
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.



Affected software

Adobe Commerce (formerly Magento Commerce)
Magento Open Source

How to mitigate CVE-2024-39403

Install updates from vendor's website.

Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2
Magento Open Source - addressed in versions 2.4.4-p10, 2.4.5-p9, 2.4.6-p7, 2.4.7-p2

External References

Related Security Bulletins