Adobe Commerce and Magento Open Source Stored Cross-Site Scripting Vulnerability Allowing Arbitrary Code Execution

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Adobe Commerce and Magento Open Source. This issue affects versions through 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, and 2.4.4-p15. The vulnerability allows a high-privileged attacker to inject malicious scripts into form fields, which could then be executed in the browser of a victim who interacts with the affected page. Exploitation requires user interaction.

Impact

Successful exploitation of this vulnerability could lead to arbitrary code execution on the victim's browser.

Remediation

Users are advised to update to Adobe Commerce version 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, or 2.4.4-p16. For Magento Open Source, users should update to version 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, or 2.4.5-p15.