{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-34258", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "datePublished": "2022-08-16T19:43:31.144119Z", "dateUpdated": "2024-09-16T17:23:56.872Z", "dateReserved": "2022-06-21T00:00:00"}, "containers": {"cna": {"title": "Adobe Commerce Stored XSS Arbitrary code execution", "datePublic": "2022-08-09T00:00:00", "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2022-10-25T00:00:00"}, "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."}], "affected": [{"vendor": "Adobe", "product": "Magento Commerce", "versions": [{"version": "unspecified", "lessThanOrEqual": "2.4.4", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.3.7-p3", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.4.3-p2", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "None", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "Cross-site Scripting (Stored XSS) (CWE-79)", "cweId": "CWE-79"}]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:07:15.589Z"}, "title": "CVE Program Container", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "710EE526-2F86-4887-9D94-17A3F20E3396", "versionEndExcluding": "2.3.7", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*", "matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*", "matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*", "matchCriteriaId": "38FFC3BA-B75E-4060-9E29-74367C7BE8A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "matchCriteriaId": "EF7E0CE5-C73F-4516-9C22-D661C1D09BED", "versionEndExcluding": "2.3.7", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "matchCriteriaId": "D26A9A5C-27A5-481C-A721-ED774F90A503", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*", "matchCriteriaId": "F124A6F4-E3B3-4065-970D-963BAAAD59CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*", "matchCriteriaId": "0F954F97-00FF-4ADC-A185-ACF0513C5294", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*", "matchCriteriaId": "E4798194-5488-4DB5-8427-0AFDDD8F4D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*", "matchCriteriaId": "8D8E981A-FE0D-47EA-A138-C8DB67DF3859", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*", "matchCriteriaId": "A573FBD1-29A3-4601-B0FA-AFEF953C05E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*", "matchCriteriaId": "9D138592-62B8-458A-9B95-9E05FDA8D63A", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*", "matchCriteriaId": "415E26EA-1394-4415-8CF0-8E61BC12AB24", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*", "matchCriteriaId": "3A428482-CEE7-4B7A-9CDE-C062E7126110", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenado de la que podr\u00eda abusar un atacante con privilegios de administrador para inyectar secuencias de comandos maliciosas en campos de formulario vulnerables. El JavaScript malicioso puede ejecutarse en el navegador de la v\u00edctima cuando \u00e9sta navega a la p\u00e1gina que contiene el campo vulnerable."}], "id": "CVE-2022-34258", "lastModified": "2024-11-21T07:09:09.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "psirt@adobe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2022-08-16T21:15:10.280", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}