Adobe Commerce Stored Cross-Site Scripting Vulnerability Allowing Session Takeover

A stored cross-site scripting vulnerability has been identified in Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier. This vulnerability allows a high-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim interacts with the page containing the compromised field, the injected JavaScript could be executed in their browser. Exploitation of this vulnerability could lead to session takeover, significantly increasing the risk to confidentiality and integrity.

Impact

Successful exploitation allows for session takeover, with a high impact on confidentiality and integrity.

Remediation

Users are advised to update to Adobe Commerce 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16 or 2.4.4-p17. Instructions for updating can be found in the Adobe Commerce release notes.