CVE-2025-24415
Published: 11 February 2025
Summary
CVE-2025-24415 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 19.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier contain a stored cross-site scripting vulnerability tracked as CVE-2025-24415. The flaw, assigned CWE-79, resides in form fields that fail to sanitize stored input, allowing malicious scripts to persist and later execute in victims' browsers. It carries a CVSS 3.1 score of 8.7 reflecting network attack vector, low complexity, low-privileged access, and required user interaction with changed scope.
A low-privileged attacker can inject JavaScript payloads into the vulnerable fields. When an administrator or other user subsequently views the affected page, the script runs in their browser context, enabling the attacker to hijack the victim's session and obtain high confidentiality and integrity impact while availability remains unaffected.
The Adobe security advisory APSB25-08 at helpx.adobe.com/security/products/magento/apsb25-08.html addresses the issue and directs customers to apply the corresponding patches for each listed branch.
EPSS remains flat at 0.0132 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3696
Vulnerability details
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed…
more
in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS enables injection of JS that executes in victims' browsers on page visit, directly facilitating drive-by compromise (T1189) and browser session hijacking for takeover (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and sanitizes inputs to vulnerable form fields, directly preventing the injection of malicious JavaScript in this stored XSS vulnerability.
Filters outputs from stored form fields to encode or strip malicious scripts, preventing their execution in victims' browsers.
Remediates the specific flaw by applying Adobe's patches as detailed in APSB25-08, eliminating the stored XSS vulnerability.