Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting vulnerability. A high-privileged attacker can inject malicious scripts into vulnerable form fields. This can lead to the execution of malicious JavaScript in a victim’s browser, potentially resulting in session takeover and high confidentiality and integrity impacts.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2025-54264 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and must convince a victim to browse to a page containing the vulnerable form field. Once the victim interacts with the page, the injected malicious script can execute in their browser, allowing the attacker to take over the victim’s session and compromise sensitive information.
Affected Products
- Adobe Commerce 2.4.9-alpha2: Affected by stored XSS vulnerability.
- Adobe Commerce 2.4.8-p2: Vulnerable to script injection attacks.
- Adobe Commerce 2.4.7-p7: Exposed to high-privilege exploitation risks.
- Adobe Commerce 2.4.6-p12: Contains vulnerabilities allowing session takeover.
- Adobe Commerce 2.4.5-p14: Susceptible to malicious JavaScript execution.
- Adobe Commerce 2.4.4-p15: Affected by high confidentiality and integrity impact risks.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the XSS issue. Additionally, implementing input validation and sanitization for user inputs can help prevent script injection attacks.