CVE-2024-20719 [Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297
CriticalCVSS 9.1
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into every admin page. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field, that could be leveraged to gain admin access.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| magento/community-edition(Packagist) | = 2.4.6 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.5 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4 | No fix listed |
| magento/community-edition(Packagist) | >= 2.4.6-p1, < 2.4.6-p4 | 2.4.6-p4 |
| magento/community-edition(Packagist) | = 2.4.6-p1 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.6-p2 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.6-p3 | No fix listed |
| magento/community-edition(Packagist) | >= 2.4.5-p1, < 2.4.5-p6 | 2.4.5-p6 |
| magento/community-edition(Packagist) | = 2.4.5-p1 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.5-p2 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.5-p3 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.5-p4 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.5-p5 | No fix listed |
| magento/community-edition(Packagist) | >= 2.4.4-p1, < 2.4.4-p7 | 2.4.4-p7 |
| magento/community-edition(Packagist) | = 2.4.4-p1 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4-p2 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4-p3 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4-p4 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4-p5 | No fix listed |
| magento/community-edition(Packagist) | = 2.4.4-p6 | No fix listed |
| magento/project-community-edition(Packagist) | <= 2.0.2 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha100 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha101 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha102 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha103 | No fix listed |
Show 75 more
| Product | Affected versions | Fixed in |
|---|---|---|
| magento/project-community-edition(Packagist) | = 0.1.0-alpha104 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha105 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha106 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha107 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha108 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha89 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha90 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha91 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha92 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha93 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha94 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha95 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha96 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha97 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha98 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.1.0-alpha99 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta1 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta10 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta11 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta2 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta3 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta4 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta5 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta6 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta7 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta8 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.42.0-beta9 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta1 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta10 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta11 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta12 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta13 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta14 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta15 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta16 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta2 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta3 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta4 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta5 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta6 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta7 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta8 | No fix listed |
| magento/project-community-edition(Packagist) | = 0.74.0-beta9 | No fix listed |
| magento/project-community-edition(Packagist) | = 1.0.0-beta | No fix listed |
| magento/project-community-edition(Packagist) | = 2.0.0 | No fix listed |
| magento/project-community-edition(Packagist) | = 2.0.0-rc | No fix listed |
| magento/project-community-edition(Packagist) | = 2.0.0-rc2 | No fix listed |
| magento/project-community-edition(Packagist) | = 2.0.1 | No fix listed |
| magento/project-community-edition(Packagist) | = 2.0.2 | No fix listed |
| Adobe Commerce | <= 2.4.4-p6 | No fix listed |
| Adobe commerce | <= 2.4.6-p3 | No fix listed |
| Adobe commerce | <= 2.4.5-p5 | No fix listed |
| Adobe commerce | <= 2.4.4-p6 | No fix listed |
| Adobe commerce | <= 2.4.3-ext-5 | No fix listed |
| Adobe commerce | <= 2.4.2-ext-5 | No fix listed |
| Adobe commerce | <= 2.4.1-ext-5 | No fix listed |
| Adobe commerce | <= 2.4.0-ext-5 | No fix listed |
| Adobe commerce | <= 2.3.7-p4-ext-5 | No fix listed |
| Adobe commerce | = 2.4.4 | No fix listed |
| Adobe commerce | = 2.4.4-p1 | No fix listed |
| Adobe commerce | = 2.4.4-p2 | No fix listed |
| Adobe commerce | = 2.4.4-p3 | No fix listed |
| Adobe commerce | = 2.4.4-p4 | No fix listed |
| Adobe commerce | = 2.4.4-p5 | No fix listed |
| Adobe commerce | = 2.4.4-p6 | No fix listed |
| Adobe commerce | = 2.4.5 | No fix listed |
| Adobe commerce | = 2.4.5-p1 | No fix listed |
| Adobe commerce | = 2.4.5-p2 | No fix listed |
| Adobe commerce | = 2.4.5-p3 | No fix listed |
| Adobe commerce | = 2.4.5-p4 | No fix listed |
| Adobe commerce | = 2.4.5-p5 | No fix listed |
| Adobe commerce | = 2.4.6 | No fix listed |
| Adobe commerce | = 2.4.6-p1 | No fix listed |
| Adobe commerce | = 2.4.6-p2 | No fix listed |
| Adobe commerce | = 2.4.6-p3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- helpx.adobe.com vendor-advisory
- github.com