Vulnerability advisory
CVE-2024-20719
[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
Also known as GHSA-264g-f7v8-q5qq
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/magento/magento2 ↗ | |
| 0f9a056c8d83c4f319626b3e56ec52a533999f25 through 6cc0d28cf66074adebc261e981eb35811601f813 | No fix listed |
Also listed as affected (17)
| |
Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.