Description
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Remediation
References
Related Vulnerabilities
Oracle Database Server Incorrect Calculation of Buffer Size Vulnerability (CVE-2004-1363)
Oracle JRE CVE-2013-5801 Vulnerability (CVE-2013-5801)
Nginx CVE-2013-2070 Vulnerability (CVE-2013-2070)
Jolokia Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-10899)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3731)