CVE-2024-20759: Magento Open Source allows Cross-Site Scripting (XSS)
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.
Other sources
Magento Open Source allows Cross-Site Scripting (XSS)
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.4-p8 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5-p7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.6-p5 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20759?
CVE-2024-20759 is classified as a high-severity stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-20759?
To fix CVE-2024-20759, update your Adobe Commerce to the latest version beyond 2.4.7-beta3.
Who is affected by CVE-2024-20759?
CVE-2024-20759 affects Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, and 2.4.7-beta3 and earlier.
What type of attack can be performed using CVE-2024-20759?
CVE-2024-20759 allows high-privileged attackers to inject malicious JavaScript into vulnerable form fields.
What are the potential impacts of CVE-2024-20759?
The potential impacts of CVE-2024-20759 include unauthorized script execution, user data theft, and session hijacking.