CVE-2025-24415
📋 TL;DR
A stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce allows low-privileged attackers to inject malicious JavaScript into vulnerable form fields. When victims browse pages containing these fields, the scripts execute in their browsers, potentially leading to session takeover. This affects Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier.
💻 Affected Systems
- Adobe Commerce
- Magento Open Source
📦 What is this software?
Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →Magento by Adobe
Magento (now Adobe Commerce) is a leading open-source e-commerce platform powering hundreds of thousands of online stores worldwide, processing billions in transactions across B2C, B2B, and marketplace models. Used by brands including Nike, Ford, Coca-Cola, Olympus, and thousands of mid-market retai...
Learn more about Magento →⚠️ Risk & Real-World Impact
Worst Case
Complete session takeover leading to administrative account compromise, data theft, and potential privilege escalation to full system control.
Likely Case
Session hijacking of customer or low-privileged admin accounts, leading to unauthorized purchases, data access, or account manipulation.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers, input validation, and output encoding in place.
🎯 Exploit Status
Requires authenticated low-privileged access. Exploitation involves identifying and targeting specific vulnerable form fields.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply security updates per Adobe advisory APSB25-08
Vendor Advisory: https://helpx.adobe.com/security/products/magento/apsb25-08.html
Restart Required: No
Instructions:
1. Review Adobe advisory APSB25-08. 2. Apply the appropriate security update for your Adobe Commerce version. 3. Verify the patch is applied correctly. 4. Test critical functionality.
🔧 Temporary Workarounds
Implement Content Security Policy
allDeploy strict CSP headers to prevent execution of unauthorized scripts
Add 'Content-Security-Policy' header with script-src directives
Input Validation and Output Encoding
allImplement server-side validation and proper output encoding for all form fields
Implement input validation libraries and output encoding functions
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with XSS protection rules
- Restrict low-privileged user access to vulnerable form fields
🔍 How to Verify
Check if Vulnerable:
Check Adobe Commerce version against affected versions list. Review form field inputs for proper sanitization.Check Version:
php bin/magento --versionVerify Fix Applied:
Verify Adobe Commerce version is updated beyond affected versions. Test form fields with XSS payloads to confirm sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual form submissions with script tags or JavaScript payloads
- Multiple failed login attempts from new locations after form submissions
Network Indicators:
- Unexpected outbound connections from user browsers after visiting form pages
SIEM Query:
source="web_logs" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=") AND uri_path="/customer/account/createpost/"