Vulnerability advisory

CVE-2024-45127

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Published Oct 10, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-magento-2024-45127GHSA-c89g-gq5r-2xw2

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
44a7b6079bcac5ba92040b16f4f74024b4f34d09 through d196d504d8b387454a123033ec2a74d7fd3d5430	No fix listed
Also listed as affected (48) `2.3.7-NA` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3` `2.3.7-p4` `2.4.0` `2.4.0-ext\-1` `2.4.1` `2.4.1-ext\-1` `2.4.2` `2.4.2-ext\-1` `2.4.2-ext\-2` `2.4.3` `2.4.3-ext\-1` `2.4.3-ext\-2` `2.4.3-ext\-3` `2.4.4-NA` `2.4.4-p1` `2.4.4-p10` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9` `2.4.5-NA` `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8` `2.4.5-p9` `2.4.6-NA` `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6` `2.4.6-p7` `2.4.7-NA` `2.4.7-b1` `2.4.7-b2`

Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVE-2024-45127

Affected versions

Repository

Description

References