CVE-2024-39400

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.7-p1 through 2.4.4-p9 and earlier

Description The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. The confidentiality and integrity impact is high as it affects other admin accounts.

Recommendations For Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9, update to a version that is not affected by this vulnerability. For Adobe Commerce versions earlier than 2.4.4-p9, update to a version that is not affected by this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.