Vulnerability advisory

CVE-2024-39403

Stored XSS through Webhook module public key configuration

Published Aug 14, 2024Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
All commits through 4c36116dcf878e127059d9be9566a119783583f2	No fix listed
0f9a056c8d83c4f319626b3e56ec52a533999f25 through d196d504d8b387454a123033ec2a74d7fd3d5430	No fix listed
Also listed as affected (63) `2.4.4-NA` `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6` `2.4.7-NA` `2.4.7-b1` `2.4.7-b2` `2.4.7-p2` `2.4.3` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.

CVE-2024-39403

Affected versions

Repository

Description

References