漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping
Vulnerability Description
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Payload is stored in an admin area, resulting in high confidentiality and integrity impact.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Adobe Commerce 跨站脚本漏洞
Vulnerability Description
Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce 2.4.7 版本之前存在跨站脚本漏洞，该漏洞源于受到存储的跨站脚本 (XSS) 漏洞的影响，低权限攻击者可能会滥用该漏洞将恶意脚本注入易受攻击的表单字段中。当受害者浏览包含易受攻击字段的页面时，恶意 JavaScript 可能会在受害者的浏览器中执行。有效负载存储在管理区域中，从而导致高度机密性和完整性影响。
CVSS Information
N/A
Vulnerability Type
N/A