8.1

CVE-2024-20759

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.

Data is provided by the National Vulnerability Database (NVD)
Adobe ≫ Commerce Version-
Adobe ≫ Commerce Version2.3.7 Update-
Adobe ≫ Commerce Version2.3.7 Updatep1
Adobe ≫ Commerce Version2.3.7 Updatep2
Adobe ≫ Commerce Version2.3.7 Updatep3
Adobe ≫ Commerce Version2.3.7 Updatep4
Adobe ≫ Commerce Version2.3.7 Updatep4-ext1
Adobe ≫ Commerce Version2.3.7 Updatep4-ext2
Adobe ≫ Commerce Version2.3.7 Updatep4-ext3
Adobe ≫ Commerce Version2.3.7 Updatep4-ext4
Adobe ≫ Commerce Version2.4.0 Update-
Adobe ≫ Commerce Version2.4.0 Updateext-1
Adobe ≫ Commerce Version2.4.0 Updateext-2
Adobe ≫ Commerce Version2.4.0 Updateext-3
Adobe ≫ Commerce Version2.4.0 Updateext-4
Adobe ≫ Commerce Version2.4.1 Update-
Adobe ≫ Commerce Version2.4.1 Updateext-1
Adobe ≫ Commerce Version2.4.1 Updateext-2
Adobe ≫ Commerce Version2.4.1 Updateext-3
Adobe ≫ Commerce Version2.4.1 Updateext-4
Adobe ≫ Commerce Version2.4.2 Update-
Adobe ≫ Commerce Version2.4.2 Updateext-1
Adobe ≫ Commerce Version2.4.2 Updateext-2
Adobe ≫ Commerce Version2.4.2 Updateext-3
Adobe ≫ Commerce Version2.4.2 Updateext-4
Adobe ≫ Commerce Version2.4.2 Updateext-6
Adobe ≫ Commerce Version2.4.2 Updatep1
Adobe ≫ Commerce Version2.4.2 Updatep2
Adobe ≫ Commerce Version2.4.3 Update-
Adobe ≫ Commerce Version2.4.3 Updateext-1
Adobe ≫ Commerce Version2.4.3 Updateext-2
Adobe ≫ Commerce Version2.4.3 Updateext-3
Adobe ≫ Commerce Version2.4.3 Updateext-4
Adobe ≫ Commerce Version2.4.3 Updateext-6
Adobe ≫ Commerce Version2.4.3 Updatep1
Adobe ≫ Commerce Version2.4.3 Updatep2
Adobe ≫ Commerce Version2.4.4 Update-
Adobe ≫ Commerce Version2.4.4 Updatep1
Adobe ≫ Commerce Version2.4.4 Updatep2
Adobe ≫ Commerce Version2.4.4 Updatep3
Adobe ≫ Commerce Version2.4.4 Updatep4
Adobe ≫ Commerce Version2.4.4 Updatep5
Adobe ≫ Commerce Version2.4.4 Updatep6
Adobe ≫ Commerce Version2.4.4 Updatep7
Adobe ≫ Commerce Version2.4.5 Update-
Adobe ≫ Commerce Version2.4.5 Updatep1
Adobe ≫ Commerce Version2.4.5 Updatep2
Adobe ≫ Commerce Version2.4.5 Updatep3
Adobe ≫ Commerce Version2.4.5 Updatep4
Adobe ≫ Commerce Version2.4.5 Updatep5
Adobe ≫ Commerce Version2.4.5 Updatep6
Adobe ≫ Commerce Version2.4.6 Update-
Adobe ≫ Commerce Version2.4.6 Updatep1
Adobe ≫ Commerce Version2.4.6 Updatep2
Adobe ≫ Commerce Version2.4.6 Updatep3
Adobe ≫ Commerce Version2.4.6 Updatep4
Adobe ≫ Commerce Version2.4.7 Update-
Adobe ≫ Commerce Version2.4.7 Updateb1
Adobe ≫ Commerce Version2.4.7 Updateb2
Adobe ≫ Commerce Version2.4.7 Updatebeta3
Adobe ≫ Magento Version2.4.4 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep1 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep2 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep3 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep4 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep5 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep6 SwEditionopen_source
Adobe ≫ Magento Version2.4.4 Updatep7 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep1 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep2 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep3 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep4 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep5 SwEditionopen_source
Adobe ≫ Magento Version2.4.5 Updatep6 SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Updatep1 SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Updatep2 SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Updatep3 SwEditionopen_source
Adobe ≫ Magento Version2.4.6 Updatep4 SwEditionopen_source
Adobe ≫ Magento Version2.4.7 Update- SwEditionopen_source
Adobe ≫ Magento Version2.4.7 Updateb1 SwEditionopen_source
Adobe ≫ Magento Version2.4.7 Updateb2 SwEditionopen_source
Adobe ≫ Magento Version2.4.7 Updatebeta3 SwEditionopen_source
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.75% 0.721
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@adobe.com 8.1 1.7 5.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.