Adobe Commerce Stored Cross-Site Scripting Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. This vulnerability allows low-privileged attackers to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the compromised field, the injected JavaScript is executed in their browser. This exploitation could lead to session takeover, significantly impacting the confidentiality and integrity of the affected user.

Impact

Exploitation of this vulnerability allows for stored Cross-Site Scripting, where injected scripts are executed in the context of the user viewing the affected page. This could lead to session hijacking and unauthorized actions on behalf of the user.