CVE-2024-20717: Stored admin XSS via PayPal authentication certificate

Published Feb 15, 2024

Updated

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Affected Software

17 affected components

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Event History

Feb 15, 2024

CVE Published

via MITRE·01:39 PM

Data Sourced

via MITRE·01:39 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-20717?

CVE-2024-20717 is considered a medium severity vulnerability due to its potential for exploitation by low-privileged attackers.

How do I fix CVE-2024-20717?

To fix CVE-2024-20717, update Adobe Commerce to the latest version that addresses this stored cross-site scripting vulnerability.

What versions of Adobe Commerce are affected by CVE-2024-20717?

CVE-2024-20717 affects Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6, and earlier versions.

What type of vulnerability is CVE-2024-20717?

CVE-2024-20717 is a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form fields.

Who can exploit CVE-2024-20717?

CVE-2024-20717 can be exploited by low-privileged attackers with access to vulnerable form fields.