Lucene search
HistoryJun 13, 2024 - 9:15 a.m.
CVE-2024-34105
adobe commerce
cross-site scripting
vulnerability
admin attacker
malicious scripts
javascript
CVSS3
4.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
27.4%
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected configurations
Node
adobecommerceMatch2.3.7-
ORadobecommerceMatch2.3.7p1
ORadobecommerceMatch2.3.7p2
ORadobecommerceMatch2.3.7p3
ORadobecommerceMatch2.3.7p4
ORadobecommerceMatch2.3.7p4-ext1
ORadobecommerceMatch2.3.7p4-ext2
ORadobecommerceMatch2.3.7p4-ext3
ORadobecommerceMatch2.3.7p4-ext4
ORadobecommerceMatch2.4.0-
ORadobecommerceMatch2.4.0ext-1
ORadobecommerceMatch2.4.0ext-2
ORadobecommerceMatch2.4.0ext-3
ORadobecommerceMatch2.4.0ext-4
ORadobecommerceMatch2.4.1-
ORadobecommerceMatch2.4.1ext-1
ORadobecommerceMatch2.4.1ext-2
ORadobecommerceMatch2.4.1ext-3
ORadobecommerceMatch2.4.1ext-4
ORadobecommerceMatch2.4.2-
ORadobecommerceMatch2.4.2ext-1
ORadobecommerceMatch2.4.2ext-2
ORadobecommerceMatch2.4.2ext-3
ORadobecommerceMatch2.4.2ext-4
ORadobecommerceMatch2.4.3-
ORadobecommerceMatch2.4.3ext-1
ORadobecommerceMatch2.4.3ext-2
ORadobecommerceMatch2.4.3ext-3
ORadobecommerceMatch2.4.3ext-4
ORadobecommerceMatch2.4.4-
ORadobecommerceMatch2.4.4p1
ORadobecommerceMatch2.4.4p2
ORadobecommerceMatch2.4.4p3
ORadobecommerceMatch2.4.4p4
ORadobecommerceMatch2.4.4p5
ORadobecommerceMatch2.4.4p6
ORadobecommerceMatch2.4.5-
ORadobecommerceMatch2.4.5p1
ORadobecommerceMatch2.4.5p2
ORadobecommerceMatch2.4.5p3
ORadobecommerceMatch2.4.5p4
ORadobecommerceMatch2.4.5p5
ORadobecommerceMatch2.4.6-
ORadobecommerceMatch2.4.6p1
ORadobecommerceMatch2.4.6p2
ORadobecommerceMatch2.4.6p3
ORadobecommerce_webhooksRange1.2.0–1.4.0
ORadobemagentoMatch2.4.4-open_source
ORadobemagentoMatch2.4.4p1open_source
ORadobemagentoMatch2.4.4p2open_source
ORadobemagentoMatch2.4.4p3open_source
ORadobemagentoMatch2.4.4p4open_source
ORadobemagentoMatch2.4.4p5open_source
ORadobemagentoMatch2.4.4p6open_source
ORadobemagentoMatch2.4.4p7open_source
ORadobemagentoMatch2.4.4p8open_source
ORadobemagentoMatch2.4.5-open_source
ORadobemagentoMatch2.4.5p1open_source
ORadobemagentoMatch2.4.5p2open_source
ORadobemagentoMatch2.4.5p3open_source
ORadobemagentoMatch2.4.5p4open_source
ORadobemagentoMatch2.4.5p5open_source
ORadobemagentoMatch2.4.5p6open_source
ORadobemagentoMatch2.4.5p7open_source
ORadobemagentoMatch2.4.6-open_source
ORadobemagentoMatch2.4.6p1open_source
ORadobemagentoMatch2.4.6p2open_source
ORadobemagentoMatch2.4.6p3open_source
ORadobemagentoMatch2.4.6p4open_source
ORadobemagentoMatch2.4.6p5open_source
ORadobemagentoMatch2.4.7b1open_source
| Vendor | Product | Version | CPE |
|---|---|---|---|
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:* |
| adobe | commerce | 2.3.7 | cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:* |
| adobe | commerce | 2.4.0 | cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:* |
Related
cve
cve
CVE-2024-34105
2024-06-13 09:15:11
vulnrichment
vulnrichment
CVE-2024-34105 Stored Cross Site Scripting in Order Comment
2024-06-13 09:04:57
osv
osv
Magento Open Source Cross-Site Scripting (XSS) vulnerability
2024-06-13 09:31:00
BIT-magento-2024-34105
2024-06-17 07:25:40
CVE-2024-34105
2024-06-13 09:15:11
github
github
Magento Open Source Cross-Site Scripting (XSS) vulnerability
2024-06-13 09:31:00
cvelist
cvelist
CVE-2024-34105 Stored Cross Site Scripting in Order Comment
2024-06-13 09:04:57
adobe
adobe
APSB24-40 : Security update available for Adobe Commerce
2024-06-11 00:00:00
CVSS3
4.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS
0.001
Percentile
27.4%
Related for NVD:CVE-2024-34105