← Back

CVE-2024-45123

nvd nist
Published: Oct 10, 2024Modified: Oct 10, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: psirt@adobe.com (Secondary)

Description

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected (116)

Adobe
3 products
Commerce
Commerce B2b
Magento
Configuration A
116 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Commerce
All versions
Commerce
Version 2.3.7
Commerce
Version 2.3.7 p1
Commerce
Version 2.3.7 p2
Commerce
Version 2.3.7 p3
Commerce
Version 2.3.7 p4-ext1
Commerce
Version 2.3.7 p4-ext2
Commerce
Version 2.3.7 p4-ext3
Commerce
Version 2.3.7 p4-ext4
Commerce
Version 2.3.7 p4
Commerce
Version 2.4.0
Commerce
Version 2.4.0
Commerce
Version 2.4.0 ext-1
Commerce
Version 2.4.0 ext-2
Commerce
Version 2.4.0 ext-3
Commerce
Version 2.4.0 ext-4
Commerce
Version 2.4.1
Commerce
Version 2.4.1
Commerce
Version 2.4.1 ext-1
Commerce
Version 2.4.1 ext-2
Commerce
Version 2.4.1 ext-3
Commerce
Version 2.4.1 ext-4
Commerce
Version 2.4.2
Commerce
Version 2.4.2
Commerce
Version 2.4.2 ext-1
Commerce
Version 2.4.2 ext-2
Commerce
Version 2.4.2 ext-3
Commerce
Version 2.4.2 ext-4
Commerce
Version 2.4.2 p1
Commerce
Version 2.4.2 p2
Commerce
Version 2.4.3
Commerce
Version 2.4.3
Commerce
Version 2.4.3 ext-1
Commerce
Version 2.4.3 ext-2
Commerce
Version 2.4.3 ext-3
Commerce
Version 2.4.3 ext-4
Commerce
Version 2.4.3 p1
Commerce
Version 2.4.3 p2
Commerce
Version 2.4.4
Commerce
Version 2.4.4 p10
Commerce
Version 2.4.4 p1
Commerce
Version 2.4.4 p2
Commerce
Version 2.4.4 p3
Commerce
Version 2.4.4 p4
Commerce
Version 2.4.4 p5
Commerce
Version 2.4.4 p6
Commerce
Version 2.4.4 p7
Commerce
Version 2.4.4 p8
Commerce
Version 2.4.4 p9
Commerce
Version 2.4.5
Commerce
Version 2.4.5 p1
Commerce
Version 2.4.5 p2
Commerce
Version 2.4.5 p3
Commerce
Version 2.4.5 p4
Commerce
Version 2.4.5 p5
Commerce
Version 2.4.5 p6
Commerce
Version 2.4.5 p7
Commerce
Version 2.4.5 p8
Commerce
Version 2.4.5 p9
Commerce
Version 2.4.6
Commerce
Version 2.4.6 p1
Commerce
Version 2.4.6 p2
Commerce
Version 2.4.6 p3
Commerce
Version 2.4.6 p4
Commerce
Version 2.4.6 p5
Commerce
Version 2.4.6 p6
Commerce
Version 2.4.6 p7
Commerce
Version 2.4.7
Commerce
Version 2.4.7 b1
Commerce
Version 2.4.7 b2
Commerce
Version 2.4.7 p1
Commerce
Version 2.4.7 p2
Adobe
Commerce B2b
Version 1.3.3
Commerce B2b
Version 1.3.3 p10
Commerce B2b
Version 1.3.4
Commerce B2b
Version 1.3.4 p9
Commerce B2b
Version 1.3.5
Commerce B2b
Version 1.3.5 p7
Commerce B2b
Version 1.4.2
Commerce B2b
Version 1.4.2 p1
Commerce B2b
Version 1.4.2 p2
Adobe
Magento
All versions
Magento
Version 2.4.3
Magento
Version 2.4.4
Magento
Version 2.4.4 p10
Magento
Version 2.4.4 p1
Magento
Version 2.4.4 p2
Magento
Version 2.4.4 p3
Magento
Version 2.4.4 p4
Magento
Version 2.4.4 p5
Magento
Version 2.4.4 p6
Magento
Version 2.4.4 p7
Magento
Version 2.4.4 p8
Magento
Version 2.4.4 p9
Magento
Version 2.4.5
Magento
Version 2.4.5 p1
Magento
Version 2.4.5 p2
Magento
Version 2.4.5 p3
Magento
Version 2.4.5 p4
Magento
Version 2.4.5 p5
Magento
Version 2.4.5 p6
Magento
Version 2.4.5 p7
Magento
Version 2.4.5 p8
Magento
Version 2.4.5 p9
Magento
Version 2.4.6
Magento
Version 2.4.6 p1
Magento
Version 2.4.6 p2
Magento
Version 2.4.6 p3
Magento
Version 2.4.6 p4
Magento
Version 2.4.6 p5
Magento
Version 2.4.6 p6
Magento
Version 2.4.6 p7
Magento
Version 2.4.7
Magento
Version 2.4.7 b1
Magento
Version 2.4.7 p1
Magento
Version 2.4.7 p2

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: psirt@adobe.com
Vendor Advisory

Timeline

No history available yet.