8.1

CVE-2024-39400

DOM XSS through integrations can impact other admins

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version <= 2.4.3
Adobe ≫ Commerce Version 2.4.4 Update -
Adobe ≫ Commerce Version 2.4.4 Update p1
Adobe ≫ Commerce Version 2.4.4 Update p2
Adobe ≫ Commerce Version 2.4.4 Update p3
Adobe ≫ Commerce Version 2.4.4 Update p4
Adobe ≫ Commerce Version 2.4.4 Update p5
Adobe ≫ Commerce Version 2.4.4 Update p6
Adobe ≫ Commerce Version 2.4.4 Update p7
Adobe ≫ Commerce Version 2.4.4 Update p8
Adobe ≫ Commerce Version 2.4.4 Update p9
Adobe ≫ Commerce Version 2.4.5 Update -
Adobe ≫ Commerce Version 2.4.5 Update p1
Adobe ≫ Commerce Version 2.4.5 Update p2
Adobe ≫ Commerce Version 2.4.5 Update p3
Adobe ≫ Commerce Version 2.4.5 Update p4
Adobe ≫ Commerce Version 2.4.5 Update p5
Adobe ≫ Commerce Version 2.4.5 Update p6
Adobe ≫ Commerce Version 2.4.5 Update p7
Adobe ≫ Commerce Version 2.4.5 Update p8
Adobe ≫ Commerce Version 2.4.6 Update -
Adobe ≫ Commerce Version 2.4.6 Update p1
Adobe ≫ Commerce Version 2.4.6 Update p2
Adobe ≫ Commerce Version 2.4.6 Update p3
Adobe ≫ Commerce Version 2.4.6 Update p4
Adobe ≫ Commerce Version 2.4.6 Update p5
Adobe ≫ Commerce Version 2.4.6 Update p6
Adobe ≫ Commerce Version 2.4.7 Update -
Adobe ≫ Commerce Version 2.4.7 Update b1
Adobe ≫ Commerce Version 2.4.7 Update b2
Adobe ≫ Commerce Version 2.4.7 Update p1
Adobe ≫ Magento SwEdition open_source Version <= 2.4.3
Adobe ≫ Magento Version 2.4.4 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p3 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p4 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p5 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p6 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p7 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p8 SwEdition open_source
Adobe ≫ Magento Version 2.4.4 Update p9 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p3 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p4 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p5 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p6 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p7 SwEdition open_source
Adobe ≫ Magento Version 2.4.5 Update p8 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p3 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p4 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p5 SwEdition open_source
Adobe ≫ Magento Version 2.4.6 Update p6 SwEdition open_source
Adobe ≫ Magento Version 2.4.7 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.7 Update b1 SwEdition open_source
Adobe ≫ Magento Version 2.4.7 Update b2 SwEdition open_source
Adobe ≫ Magento Version 2.4.7 Update p1 SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.7% 0.493
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Adobe 8.1 1.7 5.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://helpx.adobe.com/security/products/magento/apsb24-61.html
Vendor Advisory