CVE-2024-45127: Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Other sources
Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45127?
CVE-2024-45127 has been rated as a critical severity vulnerability due to its potential for exploitation via stored Cross-Site Scripting (XSS).
How do I fix CVE-2024-45127?
To fix CVE-2024-45127, upgrade to Adobe Commerce version 2.4.4-p11, 2.4.5-p10, 2.4.6-p8, or 2.4.7-p3.
What versions of Adobe Commerce are affected by CVE-2024-45127?
CVE-2024-45127 affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier.
What type of vulnerability is CVE-2024-45127?
CVE-2024-45127 is a stored Cross-Site Scripting (XSS) vulnerability.
Who can exploit CVE-2024-45127?
CVE-2024-45127 can be exploited by an admin attacker who has access to vulnerable form fields.