CVE-2024-45127: Magento Stored XSS Vulnerability in Adobe Commerce
Summary
CVE-2024-45127: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vul... Affects magento across 4 version ranges.
< 2.4.4-p11
>= 2.4.5-alpha0, < 2.4.5-p10
>= 2.4.6-alpha0, < 2.4.6-p8
>= 2.4.7-alpha0, < 2.4.7-p3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- magento/community-edition · Packagist
The same CVE-2024-45127 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adobe Commerce, also known as Magento, is a leading open-source e-commerce platform that provides businesses with a flexible shopping cart system, control over the look and feel of their online store, and a wide range of functionalities. However, certain versions of Adobe Commerce are susceptible to a stored Cross-Site Scripting (XSS) vulnerability, which can be exploited by malicious actors to inject harmful scripts into form fields, potentially compromising user security.
Vulnerability Detail
The vulnerability arises from improper validation of user input in form fields, allowing an admin attacker to inject malicious JavaScript code. When a victim accesses a page containing the compromised field, the malicious script executes in their browser, leading to potential data theft, session hijacking, or other malicious activities. This vulnerability affects Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p112.4.4-p11 -
>= 2.4.5-alpha0, < 2.4.5-p102.4.5-p10 -
>= 2.4.6-alpha0, < 2.4.6-p82.4.6-p8 -
>= 2.4.7-alpha0, < 2.4.7-p32.4.7-p3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the admin panel to trusted IP addresses and ensure that all user inputs are sanitized before processing. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The stored XSS vulnerability in Adobe Commerce poses significant risks to users and their data. It is crucial to update to the latest patched versions to ensure the security of your e-commerce platform. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure environment.
See every vulnerability recorded for magento →
FAQ
CVE-2024-45127 is a stored Cross-Site Scripting (XSS) vulnerability found in specific versions of Adobe Commerce that allows attackers to inject malicious scripts.
The affected versions include Adobe Commerce 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10, and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential data theft, session hijacking, and unauthorized actions performed on behalf of the user.
Yes, you can restrict admin panel access to trusted IP addresses and sanitize user inputs, but these are temporary measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento.
