Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2024-20717— Stored admin XSS via PayPal authentication certificate

Quick assessment

Affected

Adobe Adobe Commerce

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Adobe Commerce是美国奥多比（Adobe）公司的一种面向商家和品牌的全球领先的数字商务解决方案。 Adobe Commerce 2.4.6-p3 版本和 2.4.5-p5 版本和 2.4.4-p6 版本之前存在跨站脚本漏洞，该漏洞源于存在存储型跨站脚本 (XSS)，低权限攻击者可能会滥用该漏洞将恶意脚本注入易受攻击的表单字段中。

CVSS 5.4 · Medium EPSS 0.44% · P37 Updated Jan 25, 2025

Possible ATT&CK Techniques 3 AI

T1059 · Command and Scripting Interpreter T1505 · Server Software Component T1189 · Drive-by Compromise

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-20717

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stored admin XSS via PayPal authentication certificate

Source: CVE Program / CVE List V5

Vulnerability Description

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Vulnerability Title

Adobe Commerce 跨站脚本漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Adobe	Adobe Commerce	0 ~ 2.4.4-p6	-

II. Public POCs for CVE-2024-20717

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-20717

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-20717 (1)

https://helpx.adobe.com/security/products/magento/apsb24-03.html vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2024-20717

Same Patch Batch · Adobe · 2024-02-15 · 30 CVEs total

CVE-2024-20738	9.8 CRITICAL	Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability \| CVE-2023-44324 by
CVE-2024-20719	9.1 CRITICAL	[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing
CVE-2024-20720	9.1 CRITICAL	Command injection in data collector backup due to insufficient patching of CVE-2023-38208
CVE-2024-20727	7.8 HIGH	[TianfuCup] out-of-bounds access vulnerability when parsing jpeg2000
CVE-2024-20744	7.8 HIGH	Adobe Substance 3D Paint PICT Parsing Access Violation Write Vulnerability
CVE-2024-20729	7.8 HIGH	TALOS-2023-1890 - Adobe Acrobat Reader Annot3D object zoom event use-after-free vulnerabi
CVE-2024-20743	7.8 HIGH	Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write Vulnerability
CVE-2024-20728	7.8 HIGH	ZDI-CAN-22727: Adobe Acrobat Pro DC Annotation Out-Of-Bounds Write Remote Code Execution V
CVE-2024-20740	7.8 HIGH	Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write Vulnerability
CVE-2024-20742	7.8 HIGH	Adobe Substance 3D Paint RAS File Parsing Out-Of-Bounds Read Vulnerability
CVE-2024-20741	7.8 HIGH	Adobe Substance 3D Paint ICO Parsing Access Violation Write Vulnerability
CVE-2024-20723	7.8 HIGH	Adobe Substance 3D Painter v9.0.1Build2822 Buffer Overflow Vulnerability
CVE-2024-20731	7.8 HIGH	TALOS-2023-1901 - Adobe Acrobat Reader FileAttachment PDAnnot destroy use-after-free vulne
CVE-2024-20730	7.8 HIGH	TALOS-2023-1906 - Adobe Acrobat Reader Font CPAL integer overflow vulnerability
CVE-2024-20726	7.8 HIGH	[TianfuCup] JP2K Image Parsing Out-Of-Bounds Write
CVE-2024-20739	7.8 HIGH	ZDI-CAN-22647: Adobe Audition AVI File Parsing Heap-based Buffer Overflow Remote Code Exec
CVE-2024-20750	7.8 HIGH	Adobe Substance 3D Designer PICT Parsing Out-Of-Bounds Read Vulnerability
CVE-2024-20734	5.5 MEDIUM	ZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure Vulnera
CVE-2024-20722	5.5 MEDIUM	Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability III
CVE-2024-20724	5.5 MEDIUM	Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability II

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Adobe Commerce

Same vendor: Adobe

Same weakness: CWE-79