CVE-2022-34258: Adobe Commerce Stored XSS Arbitrary code execution
Published Aug 16, 2022
·Updated
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected Software
23 affected componentsFixes available
composer/magento/community-edition>=2.4.0<2.4.3-p3
2.4.3-p3
composer/magento/community-edition>=2.4.4<2.4.5
2.4.5
composer/magento/community-edition>=2.3.0<2.3.7-p4
2.3.7-p4
Adobe Commerce>=2.3.0<2.3.7
Adobe Commerce>=2.4.0<2.4.3
Adobe Commerce=2.3.7
Adobe Commerce=2.3.7-p1
Adobe Commerce=2.3.7-p2
Adobe Commerce=2.3.7-p3
Adobe Commerce=2.4.3
Adobe Commerce=2.4.3-p1
Adobe Commerce=2.4.3-p2
Adobe Commerce=2.4.4
Magento Magento>=2.3.0<2.3.7
Magento Magento>=2.4.0<2.4.3
Magento Magento=2.3.7
Magento Magento=2.3.7-p1
Magento Magento=2.3.7-p2
Magento Magento=2.3.7-p3
Magento Magento=2.4.3
Magento Magento=2.4.3-p1
Magento Magento=2.4.3-p2
Magento Magento=2.4.4
Event History
Aug 9, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Aug 17, 2022
Advisory Published
via GitHub·12:00 AM