CVE-2022-35698 - Adobe Commerce Stored XSS Arbitrary code execution

Back Back to CVE browser

HIGH

Adobe Commerce Stored XSS Arbitrary code execution

Published Oct 14, 2022

7.9

HIGH

CVSS 4.0

EPSS 11.27%

Description

Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

Affected products

Vendor Adobe Product Magento Commerce Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.4.4-p1
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.4.5
- Version
  unspecified
  Status
  affected
  Constraints
  <=None

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Magento Commerce

n/a

Version	Status	Constraints
unspecified	affected	<=2.4.4-p1
unspecified	affected	<=2.4.5
unspecified	affected	<=None

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/advisories/GHSA-4vj2-426r-jm3g
Advisory
https://helpx.adobe.com/security/products/magento/apsb22-48.html
PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-35698

Link	Providers	Tags
https://github.com/advisories/GHSA-4vj2-426r-jm3g		Advisory
https://helpx.adobe.com/security/products/magento/apsb22-48.html		PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-35698