CVE-2024-20717: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-20717. The vulnerability was discovered and reported to Adobe Systems Incorporated, with the CVE being created on December 4, 2023 (CVE MITRE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the vulnerable field, malicious JavaScript may be executed in their browsers (Adobe Advisory).

Organizations should update their Adobe Commerce installations to versions newer than 2.4.6-p3, 2.4.5-p5, and 2.4.4-p6 respectively. It is recommended to apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing (CIS Advisory).