Cross site scripting

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34259 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

CVE-2022-34259

CVE-2022-34259 affects Adobe Commerce (Magento) versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue is described as an improper access control that could bypass security features and impact the availability of a user’s minor feature, with exploitation not requiri...

CVE-2022-34259 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

CVE-2022-34259 Adobe Commerce Improper Access Control Security feature bypass

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature...

CVE-2022-34257 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34257 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34257 Adobe Commerce Stored XSS Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s...

CVE-2022-34257

Summary: CVE-2022-34257 refers to a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce affecting versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. The issue allows an attacker to inject malicious scripts into vulnerable form fields, with JavaScript execute...

CVE-2022-34253 Adobe Commerce XML Injection Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does...

CVE-2022-34253

Adobe Commerce/Magento Open Source instances using Widgets Module versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, or 2.4.4 and earlier are affected by an XML Injection vulnerability. An attacker with admin privileges can trigger a crafted script to achieve remote code execution without user ...

CVE-2022-34253 Adobe Commerce XML Injection Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does...

CVE-2022-34253 Adobe Commerce XML Injection Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does...

CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34255

Adobe Commerce and Magento Open Source are affected by CVE-2022-34255 (Improper Access Control) allowing privilege escalation and potential account takeover with no user interaction. Affected versions include Adobe Commerce 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. Root c...

CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34255 Adobe Commerce Improper Access Control Privilege escalation

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Access Control vulnerability that could result in Privilege escalation. An attacker with a low privilege account could leverage this vulnerability to perform an account takeover fo...

CVE-2022-34254 Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...

CVE-2022-34254

Adobe Commerce (Magento) versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier are affected by a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory) that could be abused by a low-privilege attacker to read local files and perform Stored ...

CVE-2022-34254 Adobe Commerce Improper Limitation of a Pathname to a Restricted Directory Arbitrary code execution

Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier and 2.4.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A lo...