CVE-2025-24415
Published: 11 February 2025
Summary
CVE-2025-24415 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes inputs to vulnerable form fields, directly preventing the injection of malicious JavaScript in this stored XSS vulnerability.
Filters outputs from stored form fields to encode or strip malicious scripts, preventing their execution in victims' browsers.
Remediates the specific flaw by applying Adobe's patches as detailed in APSB25-08, eliminating the stored XSS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables injection of JS that executes in victims' browsers on page visit, directly facilitating drive-by compromise (T1189) and browser session hijacking for takeover (T1185).
NVD Description
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed…
more
in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Deeper analysisAI
CVE-2025-24415 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The flaw allows malicious scripts to be injected into vulnerable form fields, with a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high confidentiality and integrity impacts.
A low-privileged attacker can exploit this vulnerability by injecting malicious JavaScript into the affected form fields. When a victim browses to the page containing the injected content, the script executes in their browser, potentially enabling session takeover and compromising sensitive data or account control.
Adobe has published security bulletin APSB25-08, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html, which provides details on mitigation, including recommended patches for the affected versions. Security practitioners should review the advisory for upgrade instructions and apply fixes promptly to vulnerable instances.
Details
- CWE(s)