CVE-2024-39400
DOM XSS through integrations can impact other admins
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
DOM XSS through integrations can impact other admins
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
CVE-2024-39400- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-37950
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
EUVD-2024-37950- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-52fg-wjxm-pp44
Magento DOM-based Cross-Site Scripting (XSS) vulnerability
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
GHSA-52fg-wjxm-pp44- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
CVE-2024-39400- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
DOM XSS through integrations can impact other admins
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
CVE-2024-39400- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-52fg-wjxm-pp44
Magento DOM-based Cross-Site Scripting (XSS) vulnerability
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
- Record
GHSA-52fg-wjxm-pp44- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/project-community-editionPackagist |
through 2.0.2 | None known |
magento/community-editionPackagist |
2.4.7-beta1 up to 2.4.7-p2 | 2.4.7-p2 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p7 | 2.4.6-p7 |
magento/community-editionPackagist |
2.4.5-p1 up to 2.4.5-p9 | 2.4.5-p9 |
magento/community-editionPackagist |
2.4.4-p1 up to 2.4.4-p10 | 2.4.4-p10 |
magento/community-editionPackagist |
2.4.7 to 2.4.7 | None known |
magento/community-editionPackagist |
2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist |
2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist |
2.4.4 to 2.4.4 | None known |
magento/project-community-editionPackagist |
through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc |
None known |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/community-editionPackagist |
2.4.7-beta1 up to 2.4.7-p2, plus listed versions 2.4.72.4.7-beta22.4.7-beta32.4.7-p1 |
2.4.7-p2 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p7, plus listed versions 2.4.6-p22.4.6-p32.4.6-p42.4.6-p52.4.6-p6 |
2.4.6-p7 |
magento/community-editionPackagist |
2.4.5-p1 up to 2.4.5-p9, plus listed versions 2.4.5-p22.4.5-p32.4.5-p42.4.5-p52.4.5-p62.4.5-p72.4.5-p8 |
2.4.5-p9 |
magento/community-editionPackagist |
2.4.4-p1 up to 2.4.4-p10, plus listed versions 2.4.4-p22.4.4-p32.4.4-p42.4.4-p52.4.4-p62.4.4-p72.4.4-p82.4.4-p9 |
2.4.4-p10 |
magento/community-editionPackagist |
Listed versions 2.4.7 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.6 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.5 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39400 is a high vulnerability (CVSS 8.1) in Adobe Commerce, published August 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in magento/community-edition 2.4.7-p2.
References
Left out here: 2 versions. The JSON record has them.