CVE-2024-20759: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20759?
CVE-2024-20759 is classified as a high-severity stored Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-20759?
To fix CVE-2024-20759, update your Adobe Commerce to the latest version beyond 2.4.7-beta3.
Who is affected by CVE-2024-20759?
CVE-2024-20759 affects Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, and 2.4.7-beta3 and earlier.
What type of attack can be performed using CVE-2024-20759?
CVE-2024-20759 allows high-privileged attackers to inject malicious JavaScript into vulnerable form fields.
What are the potential impacts of CVE-2024-20759?
The potential impacts of CVE-2024-20759 include unauthorized script execution, user data theft, and session hijacking.