Kurz gesagt
- CVE-2025-47110 ist eine Schwachstelle (HOCH (CVSS 8.4)) in magento/community-edition, commerce (adobe), commerce b2b (adobe).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.73%, höher als bei 54.2% aller Schwachstellen.
- Abhilfe: auf 2.4.6-p11, 2.4.7-p6, 2.4.8-p1, 2.4.5-p13 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| magento/community-edition Packagist | = 2.4.5= 2.4.6= 2.4.7= 2.4.8≥ 2.4.6-p1, < 2.4.6-p11≥ 2.4.7-beta1, < 2.4.7-p6≥ 2.4.8-beta1, < 2.4.8-p1< 2.4.5-p13
| 2.4.6-p112.4.7-p62.4.8-p12.4.5-p13
|
| commerce | = 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8
| No fix yet |
| commerce b2b | = 1.3.3= 1.3.4= 1.3.5= 1.4.2= 1.5.2
| No fix yet |
| magento | = 2.4.5= 2.4.6= 2.4.7= 2.4.8
| No fix yet |
Description
Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
NVD description
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed to that of other high-privileged accounts, leading to a high impact on confidentiality, integrity, and availability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free