CVE-2024-45127
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
En bref Sévérité MEDIUM 4.8 EPSS EPSS 0.49 % · centile 42 (2026-10-27) État PUBLISHED Publiée 2024-10-10 Mise à jour 2024-10-10 Attribuée par adobe Statut NVD Analyzed Description Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N adobe CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N NVD · psirt@adobe.com (Secondary)
Faiblesses (CWE)
Avis
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*+76 autres Produits affectés
Références
Sources
