CVE-2024-39403

Description

Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality impact is high due to the attacker being able to exfiltrate sensitive information.

How to fix CVE-2024-39403

To remediate CVE-2024-39403, upgrade the affected package to a fixed version below.

• —upgrade to 2.4.7-p2 or later
• —no fix listed

Is CVE-2024-39403 being exploited?

Low — EPSS is 2.8%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 2.4.7-beta1, < 2.4.7-p2
• from 0, <= 2.0.2

CVSS scores

References (3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-39403
• PATCHgithub.com/magento/magento2
• WEBhelpx.adobe.com/security/products/magento/apsb24-61.html