Magneto contains stored XSS vulnerability

高 8.4CVE-2025-47110 · GHSA-j934-vjh5-vf9r · 10/06/2025 公開 · 17/06/2026 更新

要点

CVE-2025-47110 は magento/community-edition, commerce (adobe), commerce b2b (adobe) に影響する深刻度「高」 (CVSS 8.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.2% より高い）。
対処：2.4.6-p11, 2.4.7-p6, 2.4.8-p1, 2.4.5-p13 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
magento/community-edition Packagist	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8≥ 2.4.6-p1, < 2.4.6-p11≥ 2.4.7-beta1, < 2.4.7-p6≥ 2.4.8-beta1, < 2.4.8-p1< 2.4.5-p13`	`2.4.6-p112.4.7-p62.4.8-p12.4.5-p13`
commerce adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8`	修正版なし
commerce b2b adobe	`= 1.3.3= 1.3.4= 1.3.5= 1.4.2= 1.5.2`	修正版なし
magento adobe	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8`	修正版なし

概要

Magento versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

NVD の説明

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Scope is changed to that of other high-privileged accounts, leading to a high impact on confidentiality, integrity, and availability.