CVE-2022-34258 : Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Published 2022-08-16 21:15:10

Updated 2022-11-04 02:50:51

Source Adobe Systems Incorporated

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2022-34258

Adobe » Commerce
Versions from including (>=) 2.4.0 and before (<) 2.4.3
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
Matching versions
Adobe » Commerce
Versions from including (>=) 2.3.0 and before (<) 2.3.7
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.3.7 Update P1
cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.3.7 Update P2
cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.4.3
cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.4.3 Update P1
cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.3.7
cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.3.7 Update P3
cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.4.3 Update P2
cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*
Matching versions
Adobe » Commerce » Version: 2.4.4
cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
Matching versions
Magento » Magento » Commerce Edition
Versions from including (>=) 2.3.0 and before (<) 2.3.7
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Commerce Edition
Versions from including (>=) 2.4.0 and before (<) 2.4.3
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.3.7 Update P1 Commerce Edition
cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.3.7 Update P2 Commerce Edition
cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.4.3 Commerce Edition
cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.4.3 Update P1 Commerce Edition
cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.4.4 Commerce Edition
cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.3.7 Commerce Edition
cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.3.7 Update P3 Commerce Edition
cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*
Matching versions
Magento » Magento » Version: 2.4.3 Update P2 Commerce Edition
cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-34258

EPSS FAQ

0.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-34258

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
4.8	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	1.7	2.7	Adobe Systems Incorporated
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-34258

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: psirt@adobe.com (Primary)

References for CVE-2022-34258

https://helpx.adobe.com/security/products/magento/apsb22-38.html

Adobe Security Bulletin
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-34258

Products affected by CVE-2022-34258

Exploit prediction scoring system (EPSS) score for CVE-2022-34258

CVSS scores for CVE-2022-34258

CWE ids for CVE-2022-34258

References for CVE-2022-34258