CVE-2025-24438
Published: 11 February 2025
Summary
CVE-2025-24438 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the failure to sanitize or escape user input in vulnerable form fields, preventing malicious script injection by low-privileged attackers.
Filters output from affected form fields to prevent execution of injected JavaScript in victims' browsers when viewing the page.
Requires timely identification, reporting, and correction of the specific stored XSS flaw in Adobe Commerce, aligning with official patching guidance.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing web app enables exploitation via T1190; directly facilitates browser session hijacking (T1185) for session takeover as described.
NVD Description
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed…
more
in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
Deeper analysisAI
CVE-2025-24438 is a stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The flaw resides in vulnerable form fields that fail to properly sanitize or escape user input, allowing persistent injection of malicious JavaScript. Published on 2025-02-11, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and changed scope.
A low-privileged attacker with access to the platform can exploit this by submitting malicious payloads into the affected form fields. When a victim user subsequently views the page containing the injected content, the script executes in their browser context, bypassing same-origin policy restrictions. This enables session takeover, compromising the victim's authenticated session and leading to high confidentiality and integrity impacts, such as data theft or account hijacking.
The official Adobe Product Security Bulletin (APSB25-08) provides details on mitigation, available at https://helpx.adobe.com/security/products/magento/apsb25-08.html. Security practitioners should consult this advisory for patch information, upgrade paths, and any interim workarounds for affected Adobe Commerce deployments.
Details
- CWE(s)