CVE-2022-34258 - Vulnerability Details

Vendors	Products
Adobe	Commerce
Magento	Magento

Link	Providers
https://helpx.adobe.com/security/products/magento/apsb22-38.html

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-34258", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "datePublished": "2022-08-16T19:43:31.144119Z", "dateUpdated": "2024-09-16T17:23:56.872Z", "dateReserved": "2022-06-21T00:00:00"}, "containers": {"cna": {"title": "Adobe Commerce Stored XSS Arbitrary code execution", "datePublic": "2022-08-09T00:00:00", "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2022-10-25T00:00:00"}, "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."}], "affected": [{"vendor": "Adobe", "product": "Magento Commerce", "versions": [{"version": "unspecified", "lessThanOrEqual": "2.4.4", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.3.7-p3", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "2.4.3-p2", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThanOrEqual": "None", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "Cross-site Scripting (Stored XSS) (CWE-79)", "cweId": "CWE-79"}]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T09:07:15.589Z"}, "title": "CVE Program Container", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-34258 (string)

assignerOrgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

assignerShortName : adobe (string)

datePublished : 2022-08-16T19:43:31.144119Z (string)

dateUpdated : 2024-09-16T17:23:56.872Z (string)

dateReserved : 2022-06-21T00:00:00 (string)

}

containers : { »

cna : { »

title : Adobe Commerce Stored XSS Arbitrary code execution (string)

datePublic : 2022-08-09T00:00:00 (string)

providerMetadata : { »

orgId : 078d4453-3bcd-4900-85e6-15281da43538 (string)

shortName : adobe (string)

dateUpdated : 2022-10-25T00:00:00 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. (string)

}

]

affected : [ »

0 : { »

vendor : Adobe (string)

product : Magento Commerce (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThanOrEqual : 2.4.4 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThanOrEqual : 2.3.7-p3 (string)

status : affected (string)

versionType : custom (string)

}

2 : { »

version : unspecified (string)

lessThanOrEqual : 2.4.3-p2 (string)

status : affected (string)

versionType : custom (string)

}

3 : { »

version : unspecified (string)

lessThanOrEqual : None (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

version : 3.1 (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (string)

attackVector : NETWORK (string)

attackComplexity : LOW (string)

privilegesRequired : HIGH (string)

userInteraction : REQUIRED (string)

scope : CHANGED (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : Cross-site Scripting (Stored XSS) (CWE-79) (string)

cweId : CWE-79 (string)

}

]

}

]

source : { »

discovery : EXTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T09:07:15.589Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "710EE526-2F86-4887-9D94-17A3F20E3396", "versionEndExcluding": "2.3.7", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*", "matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*", "matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*", "matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*", "matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*", "matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*", "matchCriteriaId": "38FFC3BA-B75E-4060-9E29-74367C7BE8A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*", "matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "matchCriteriaId": "EF7E0CE5-C73F-4516-9C22-D661C1D09BED", "versionEndExcluding": "2.3.7", "versionStartIncluding": "2.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "matchCriteriaId": "D26A9A5C-27A5-481C-A721-ED774F90A503", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*", "matchCriteriaId": "F124A6F4-E3B3-4065-970D-963BAAAD59CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*", "matchCriteriaId": "0F954F97-00FF-4ADC-A185-ACF0513C5294", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*", "matchCriteriaId": "E4798194-5488-4DB5-8427-0AFDDD8F4D0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*", "matchCriteriaId": "8D8E981A-FE0D-47EA-A138-C8DB67DF3859", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*", "matchCriteriaId": "A573FBD1-29A3-4601-B0FA-AFEF953C05E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*", "matchCriteriaId": "9D138592-62B8-458A-9B95-9E05FDA8D63A", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*", "matchCriteriaId": "415E26EA-1394-4415-8CF0-8E61BC12AB24", "vulnerable": true}, {"criteria": "cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*", "matchCriteriaId": "3A428482-CEE7-4B7A-9CDE-C062E7126110", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) est\u00e1n afectadas por una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenado de la que podr\u00eda abusar un atacante con privilegios de administrador para inyectar secuencias de comandos maliciosas en campos de formulario vulnerables. El JavaScript malicioso puede ejecutarse en el navegador de la v\u00edctima cuando \u00e9sta navega a la p\u00e1gina que contiene el campo vulnerable."}], "id": "CVE-2022-34258", "lastModified": "2024-11-21T07:09:09.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "psirt@adobe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2022-08-16T21:15:10.280", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 710EE526-2F86-4887-9D94-17A3F20E3396 (string)

versionEndExcluding : 2.3.7 (string)

versionStartIncluding : 2.3.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* (string)

matchCriteriaId : BF96C367-576B-437B-A86C-CB9CA65CB481 (string)

versionEndExcluding : 2.4.3 (string)

versionStartIncluding : 2.4.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:* (string)

matchCriteriaId : 4346BF61-743B-4BBE-AC90-9954FEE6E943 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:* (string)

matchCriteriaId : 9F471E19-8AFE-4A6C-88EA-DF94428518F7 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:* (string)

matchCriteriaId : 27E5B990-1E1C-46AC-815F-AF737D211C16 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:* (string)

matchCriteriaId : 8D1598F4-AA41-4F94-A986-E603DC42AC8B (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:* (string)

matchCriteriaId : 7B503C35-8C90-4A24-8E60-722CDBBF556B (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:* (string)

matchCriteriaId : 8A453C85-A14A-47B8-B91D-3906BBE42A78 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:* (string)

matchCriteriaId : 38FFC3BA-B75E-4060-9E29-74367C7BE8A8 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:* (string)

matchCriteriaId : D258D9EF-94FB-41F0-A7A5-7F66FA7A0055 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* (string)

matchCriteriaId : EF7E0CE5-C73F-4516-9C22-D661C1D09BED (string)

versionEndExcluding : 2.3.7 (string)

versionStartIncluding : 2.3.0 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* (string)

matchCriteriaId : D26A9A5C-27A5-481C-A721-ED774F90A503 (string)

versionEndExcluding : 2.4.3 (string)

versionStartIncluding : 2.4.0 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:* (string)

matchCriteriaId : F124A6F4-E3B3-4065-970D-963BAAAD59CB (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:* (string)

matchCriteriaId : 0F954F97-00FF-4ADC-A185-ACF0513C5294 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:* (string)

matchCriteriaId : E4798194-5488-4DB5-8427-0AFDDD8F4D0E (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:* (string)

matchCriteriaId : 8D8E981A-FE0D-47EA-A138-C8DB67DF3859 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:* (string)

matchCriteriaId : A573FBD1-29A3-4601-B0FA-AFEF953C05E5 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:* (string)

matchCriteriaId : 9D138592-62B8-458A-9B95-9E05FDA8D63A (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:* (string)

matchCriteriaId : 415E26EA-1394-4415-8CF0-8E61BC12AB24 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:* (string)

matchCriteriaId : 3A428482-CEE7-4B7A-9CDE-C062E7126110 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. (string)

}

1 : { »

lang : es (string)

value : Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) están afectadas por una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenado de la que podría abusar un atacante con privilegios de administrador para inyectar secuencias de comandos maliciosas en campos de formulario vulnerables. El JavaScript malicioso puede ejecutarse en el navegador de la víctima cuando ésta navega a la página que contiene el campo vulnerable. (string)

}

]

id : CVE-2022-34258 (string)

lastModified : 2024-11-21T07:09:09.953 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.7 (number)

impactScore : 2.7 (number)

source : psirt@adobe.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.7 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Secondary (string)

}

]

}

published : 2022-08-16T21:15:10.280 (string)

references : [ »

0 : { »

source : psirt@adobe.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://helpx.adobe.com/security/products/magento/apsb22-38.html (string)

}

]

sourceIdentifier : psirt@adobe.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : psirt@adobe.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object