A stored Cross-Site Scripting vulnerability in Adobe Commerce and Magento Open Source may allow low-privileged attackers to execute malicious scripts in a victim's browser, potentially leading to session takeover.

This is a stored Cross-Site Scripting (XSS) flaw where a low-privileged attacker can inject malicious scripts into form fields. The script executes when an unsuspecting user visits the affected page, requiring user interaction to trigger the payload.

The exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of user sessions. By achieving session takeover, an attacker could gain unauthorized access to administrative or sensitive user accounts, leading to potential data exfiltration or unauthorized configuration changes. Given the CVSS score of 8.7, this is considered a high-severity issue that demands prompt remediation to prevent account compromise.

Immediate Action: Update to the patched versions provided by Adobe, specifically 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17 (depending on your specific product and edition).

Proactive Monitoring: Review web server logs for suspicious activity involving form submissions or unexpected JavaScript payloads. Monitor user session logs for signs of anomalous access patterns or account hijacking attempts.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts. Additionally, configure a Web Application Firewall (WAF) to detect and block common XSS attack patterns in form field inputs.

Public Exploit Available: No

The presence of a stored XSS vulnerability in a commerce platform presents a clear risk of account takeover and potential financial or data loss. Security teams must prioritize updating to the latest vendor-provided patches as the primary defense against this vulnerability. Failure to remediate promptly increases the window of opportunity for attackers to compromise user sessions.