CVSS 3.1 Score 5.4 of 10 (medium)


Published Feb 15, 2024
Updated: Feb 16, 2024


The vulnerability with the CVE ID name CVE-2024-20717 affects Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6, and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim visits the page containing the vulnerable field, the injected JavaScript can be executed in their browser. The vulnerability has a risk score of 25 and is rated as MEDIUM severity with a base score of 5.4 according to NIST's National Vulnerability Database (NVD). The attack vector is through the network, and low privileges are required for exploitation. The impact on integrity and confidentiality is low, while availability is not affected.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-20717 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options