CVE-2025-24438

CVE-2025-24438 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The flaw resides in vulnerable form fields that fail to properly sanitize or escape user input, allowing persistent injection of malicious JavaScript. Published on 2025-02-11, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and changed scope.

A low-privileged attacker with access to the platform can exploit this by submitting malicious payloads into the affected form fields. When a victim user subsequently views the page containing the injected content, the script executes in their browser context, bypassing same-origin policy restrictions. This enables session takeover, compromising the victim's authenticated session and leading to high confidentiality and integrity impacts, such as data theft or account hijacking.

The official Adobe Product Security Bulletin (APSB25-08) provides details on mitigation, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html. Security practitioners should consult this advisory for patch information, upgrade paths, and any interim workarounds for affected Adobe Commerce deployments.