CVE-2022-34258
Published: 16 August 2022
Summary
CVE-2022-34258 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 4.8 (Medium).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Commerce versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier contain a stored cross-site scripting vulnerability tracked as CVE-2022-34258. The flaw, assigned CWE-79, resides in form fields that accept and store administrator-supplied input without adequate sanitization, allowing script content to persist and later render in other users' browsers. The issue carries a CVSS 3.1 score of 4.8 reflecting network attack vector, low attack complexity, high privileges required, and required user interaction.
An authenticated administrator can place malicious JavaScript into the affected fields. When another user with a privileged browser session subsequently views the page hosting the stored content, the script executes in that victim's context, enabling actions such as session token theft or limited administrative interface manipulation under the reflected origin.
Adobe published security bulletin APSB22-38, available at https://helpx.adobe.com/security/products/magento/apsb22-38.html, which addresses the vulnerability and supplies remediation guidance for supported Magento and Adobe Commerce releases.
The associated EPSS score has remained flat at 0.1618 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6487
Vulnerability details
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields.…
more
Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.