CVE-2024-34105: Stored Cross Site Scripting in Order Comment

Q: What is the severity of CVE-2024-34105?

CVE-2024-34105 has been classified as a medium severity stored Cross-Site Scripting vulnerability.

Q: How do I fix CVE-2024-34105?

To fix CVE-2024-34105, upgrade to Adobe Commerce version 2.4.4-p9 or later.

Q: Which versions are affected by CVE-2024-34105?

CVE-2024-34105 affects Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, and earlier.

Q: What type of vulnerability is CVE-2024-34105?

CVE-2024-34105 is a stored Cross-Site Scripting (XSS) vulnerability.

Q: Can CVE-2024-34105 be exploited remotely?

Yes, CVE-2024-34105 can be exploited by an admin attacker to inject malicious scripts into form fields.

Published Jun 13, 2024

Updated

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Affected Software

78 affected componentsFixes available

composer/magento/community-edition<2.4.4-p9

2.4.4-p9

composer/magento/community-edition>=2.4.5-p1<2.4.5-p8

2.4.5-p8

composer/magento/community-edition>=2.4.6-p1<2.4.6-p6

2.4.6-p6

composer/magento/community-edition=2.4.4

composer/magento/community-edition=2.4.5

composer/magento/community-edition=2.4.6

composer/magento/community-edition=2.4.7

Adobe Commerce=2.3.7

Adobe Commerce=2.3.7-p1

Adobe Commerce=2.3.7-p2

Adobe Commerce=2.3.7-p3

Adobe Commerce=2.3.7-p4

Adobe Commerce=2.3.7-p4-ext1

Adobe Commerce=2.3.7-p4-ext2

Adobe Commerce=2.3.7-p4-ext3

Adobe Commerce=2.3.7-p4-ext4

Adobe Commerce=2.4.0

Adobe Commerce=2.4.0-ext-1

Adobe Commerce=2.4.0-ext-2

Adobe Commerce=2.4.0-ext-3

Adobe Commerce=2.4.0-ext-4

Adobe Commerce=2.4.1

Adobe Commerce=2.4.1-ext-1

Adobe Commerce=2.4.1-ext-2

Adobe Commerce=2.4.1-ext-3

Adobe Commerce=2.4.1-ext-4

Adobe Commerce=2.4.2

Adobe Commerce=2.4.2-ext-1

Adobe Commerce=2.4.2-ext-2

Adobe Commerce=2.4.2-ext-3

Adobe Commerce=2.4.2-ext-4

Adobe Commerce=2.4.3

Adobe Commerce=2.4.3-ext-1

Adobe Commerce=2.4.3-ext-2

Adobe Commerce=2.4.3-ext-3

Adobe Commerce=2.4.3-ext-4

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Adobe Commerce Webhooks>=1.2.0<=1.4.0

Adobe Magento=2.4.4

Adobe Magento=2.4.4-p1

Adobe Magento=2.4.4-p2

Adobe Magento=2.4.4-p3

Adobe Magento=2.4.4-p4

Adobe Magento=2.4.4-p5

Adobe Magento=2.4.4-p6

Adobe Magento=2.4.4-p7

Adobe Magento=2.4.4-p8

Adobe Magento=2.4.5

Adobe Magento=2.4.5-p1

Adobe Magento=2.4.5-p2

Adobe Magento=2.4.5-p3

Adobe Magento=2.4.5-p4

Adobe Magento=2.4.5-p5

Adobe Magento=2.4.5-p6

Adobe Magento=2.4.5-p7

Adobe Magento=2.4.6

Adobe Magento=2.4.6-p1

Adobe Magento=2.4.6-p2

Adobe Magento=2.4.6-p3

Adobe Magento=2.4.6-p4

Adobe Magento=2.4.6-p5

Adobe Magento=2.4.7-b1

Event History

Jun 13, 2024

CVE Published

via MITRE·09:04 AM

Data Sourced

via MITRE·09:04 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Advisory Published

via GitHub·09:31 AM

Frequently Asked Questions

What is the severity of CVE-2024-34105?

CVE-2024-34105 has been classified as a medium severity stored Cross-Site Scripting vulnerability.

How do I fix CVE-2024-34105?

To fix CVE-2024-34105, upgrade to Adobe Commerce version 2.4.4-p9 or later.

Which versions are affected by CVE-2024-34105?