CVE-2025-24412
Published: 11 February 2025
Summary
CVE-2025-24412 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored cross-site scripting vulnerability tracked as CVE-2025-24412. The flaw, assigned CWE-79, allows injection of malicious scripts into vulnerable form fields and carries a CVSS 3.1 score of 8.7 reflecting network attack vector, low complexity, low-privileged access, and required user interaction with changed scope.
A low-privileged attacker can supply crafted input that persists in the application and executes JavaScript in the browser of any user who later views the affected page. Successful exploitation enables session takeover with high impact to confidentiality and integrity.
Adobe has published advisory APSB25-08 at https://helpx.adobe.com/security/products/magento/apsb25-08.html detailing patches for the listed versions. The associated EPSS score remains flat at 0.0132 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3693
Vulnerability details
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed…
more
in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS vulnerability allows injection and execution of malicious JavaScript in the victim's browser, directly enabling browser session hijacking via cookie theft or user impersonation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of user inputs to vulnerable form fields, directly preventing the storage of malicious scripts in Adobe Commerce.
SI-15 mandates filtering of information outputs from affected fields, blocking execution of injected JavaScript in victims' browsers.
SI-2 ensures timely remediation of the specific flaw in Adobe Commerce versions through patching as recommended in APSB25-08.