CVE-2024-39403CWE-79

Stored XSS through Webhook module public key configuration

High · published August 14, 2024

CVSS v3.1
7.6
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00536 · 44.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-08-14T11:57Z
EPSS history
Timeline
  • 14 AUG 11:57Z
    Stored XSS through Webhook module public key configuration
    cvelistv5