Patchfirst
Patchfirst
CVE-2022-34258 Medium · 4.8 EPSS 69.2%

Adobe Commerce Stored XSS Arbitrary code execution

Adobe · Magento Commerce

Summary

Adobe Commerce and Magento Commerce contain a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, affecting versions 2.4.3-p2 and earlier, 2.3.7-p3 and earlier, and 2.4.4 and earlier. An attacker with admin privileges can inject malicious JavaScript that executes in a victim's browser when they load the page containing the affected field, which requires the victim to browse to that page.

Official description · CVE.org

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Breakdown
23.2 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 16 Aug 2022. No public exploit code or confirmed exploitation is recorded.

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: magento/community-edition.

Packagistmagento/community-editionGHSA-5m55-g8pv-x8ww

Upgrade to 2.4.5

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2023-22249, CVE-2024-20720, +1).

Still affected on this line by CVE-2025-54236 (no fix published).

Set the version to 2.4.5 or later in your composer.json.

The first fix for CVE-2022-34258.

Affected versions, by release line

If you runUpgrade to
2.4.4 up to 2.4.52.4.5
2.4.0 up to 2.4.3-p3

Still affected on this line by CVE-2024-34102 (fixed in 2.4.4-p9, a newer line); CVE-2025-54236 (no fix published).

2.4.3-p3
2.3.0 up to 2.3.7-p4

Still affected on this line by CVE-2024-34102 (fixed in 2.4.4-p9, a newer line); CVE-2025-54236 (no fix published).

2.3.7-p4

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

Other 1

helpx.adobe.com/security/products/magento/apsb22-38.html
↑ ↓ chooseEnter openEsc close