CVE-2025-24438
Published: 11 February 2025
Summary
CVE-2025-24438 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Commerce. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier contain a stored cross-site scripting vulnerability tracked as CVE-2025-24438. The flaw, assigned CWE-79, allows injection of malicious scripts into vulnerable form fields; when another user views the affected page the script executes in the browser. The issue carries a CVSS 3.1 score of 8.7 reflecting network attack vector, low attack complexity, low privileges required, and high impact on confidentiality and integrity.
A low-privileged attacker with the ability to supply content through the vulnerable fields can store JavaScript that runs in the context of a higher-privileged victim. Successful exploitation enables session takeover, giving the attacker the victim’s privileges within the Adobe Commerce instance.
The Adobe security advisory APSB25-08 recommends applying the patches released for the listed versions; administrators should upgrade to the fixed releases and review any custom form fields that accept user input. The associated EPSS score has remained flat at 0.0446 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3717
Vulnerability details
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed…
more
in a victim’s browser when they browse to the page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing web app enables exploitation via T1190; directly facilitates browser session hijacking (T1185) for session takeover as described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the failure to sanitize or escape user input in vulnerable form fields, preventing malicious script injection by low-privileged attackers.
Filters output from affected form fields to prevent execution of injected JavaScript in victims' browsers when viewing the page.
Requires timely identification, reporting, and correction of the specific stored XSS flaw in Adobe Commerce, aligning with official patching guidance.