Vulnerability advisory
CVE-2022-34258
Adobe Commerce Stored XSS Arbitrary code execution
Also known as BIT-magento-2022-34258GHSA-5m55-g8pv-x8ww
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/devdocs ↗ | |
| 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 through 81e9594ffa9c24a761ebd3a3c7c076078443f1e5 | No fix listed |
Also listed as affected (3)
| |
| GIT github.com/magento/magento2 ↗ | |
| f4c1d7526f05bdfb1327b0701cc345f94aadcaed to before 44a7b6079bcac5ba92040b16f4f74024b4f34d09 | 44a7b6079bcac5ba92040b16f4f74024b4f34d09 |
| 6729b6e01368248abc33300208eb292c95050203 to before 4c36116dcf878e127059d9be9566a119783583f2 | 4c36116dcf878e127059d9be9566a119783583f2 |
| 44a7b6079bcac5ba92040b16f4f74024b4f34d09 through 0f9a056c8d83c4f319626b3e56ec52a533999f25 | No fix listed |
Also listed as affected (8)
| |
Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.