CVE-2025-24414
📋 TL;DR
A stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce allows low-privileged attackers to inject malicious JavaScript into vulnerable form fields. When victims browse pages containing these fields, the scripts execute in their browsers, potentially leading to session takeover. This affects Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier.
💻 Affected Systems
- Adobe Commerce
- Magento Open Source
📦 What is this software?
Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →⚠️ Risk & Real-World Impact
Worst Case
Complete session takeover leading to administrative account compromise, data theft, and potential full system control if admin sessions are hijacked.
Likely Case
Session hijacking of customer or low-privileged user accounts, leading to unauthorized purchases, personal data theft, and account takeover.
If Mitigated
Limited to isolated user sessions with proper CSP headers and input validation, preventing successful exploitation.
🎯 Exploit Status
Requires authenticated low-privileged access. Stored XSS requires specific form field targeting and victim interaction.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Adobe Commerce 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12 or later
Vendor Advisory: https://helpx.adobe.com/security/products/magento/apsb25-08.html
Restart Required: No
Instructions:
1. Backup your Adobe Commerce instance. 2. Apply the security patch via Composer: composer require magento/security-package. 3. Clear cache: php bin/magento cache:clean. 4. Verify patch application.
🔧 Temporary Workarounds
Implement Content Security Policy (CSP)
allAdd CSP headers to restrict script execution from untrusted sources
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Or configure in Magento admin: Stores > Configuration > Advanced > Developer > Security
Input Validation Sanitization
allImplement additional input validation on all form fields
Implement custom validation in form controllers using htmlspecialchars() or similar functions
🧯 If You Can't Patch
- Restrict low-privileged user access to vulnerable form fields
- Implement Web Application Firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check Adobe Commerce version via admin panel or command: php bin/magento --versionCheck Version:
php bin/magento --versionVerify Fix Applied:
Verify version is patched: php bin/magento --version should show 2.4.8-beta2, 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12 or later📡 Detection & Monitoring
Log Indicators:
- Unusual form submissions with script tags
- Multiple failed login attempts from same session
- Admin actions from unexpected user accounts
Network Indicators:
- HTTP requests containing script payloads in form data
- Unexpected redirects to external domains
SIEM Query:
source="web_logs" AND ("<script>" OR "javascript:" OR "onload=" OR "onerror=") AND uri_path="/customer/account/*"