CVE-2022-34258
Status: ModifiedMedium (4.8)—
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Base score: 4.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 69%
- Percentile among all scored CVEs: 99
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-79
References
Raw JSON (NVD)
Show
{
"id": "CVE-2022-34258",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2022-34258",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-04-23T13:05:10.743615Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 4.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 1.7
},
{
"type": "Secondary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 4.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 1.7
}
]
},
"affected": [
{
"source": "psirt@adobe.com",
"affectedData": [
{
"vendor": "Adobe",
"product": "Magento Commerce",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "2.4.4"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "2.3.7-p3"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "2.4.3-p2"
},
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "None"
}
]
}
]
}
],
"published": "2022-08-16T21:15:10.280",
"references": [
{
"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html",
"tags": [
"Vendor Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@adobe.com",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field."
},
{
"lang": "es",
"value": "Adobe Commerce versiones 2.4.3-p2 (y anteriores), 2.3.7-p3 (y anteriores) y 2.4.4 (y anteriores) están afectadas por una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenado de la que podría abusar un atacante con privilegios de administrador para inyectar secuencias de comandos maliciosas en campos de formulario vulnerables. El JavaScript malicioso puede ejecutarse en el navegador de la víctima cuando ésta navega a la página que contiene el campo vulnerable."
}
],
"lastModified": "2026-06-17T04:49:59.700",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "710EE526-2F86-4887-9D94-17A3F20E3396",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481",
"versionEndExcluding": "2.4.3",
"versionStartIncluding": "2.4.0"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4346BF61-743B-4BBE-AC90-9954FEE6E943"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D1598F4-AA41-4F94-A986-E603DC42AC8B"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38FFC3BA-B75E-4060-9E29-74367C7BE8A8"
},
{
"criteria": "cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D258D9EF-94FB-41F0-A7A5-7F66FA7A0055"
},
{
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF7E0CE5-C73F-4516-9C22-D661C1D09BED",
"versionEndExcluding": "2.3.7",
"versionStartIncluding": "2.3.0"
},
{
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D26A9A5C-27A5-481C-A721-ED774F90A503",
"versionEndExcluding": "2.4.3",
"versionStartIncluding": "2.4.0"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F124A6F4-E3B3-4065-970D-963BAAAD59CB"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.3.7:p1:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F954F97-00FF-4ADC-A185-ACF0513C5294"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.3.7:p2:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4798194-5488-4DB5-8427-0AFDDD8F4D0E"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.3.7:p3:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D8E981A-FE0D-47EA-A138-C8DB67DF3859"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.4.3:-:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A573FBD1-29A3-4601-B0FA-AFEF953C05E5"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.4.3:p1:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9D138592-62B8-458A-9B95-9E05FDA8D63A"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.4.3:p2:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "415E26EA-1394-4415-8CF0-8E61BC12AB24"
},
{
"criteria": "cpe:2.3:a:magento:magento:2.4.4:-:*:*:commerce:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A428482-CEE7-4B7A-9CDE-C062E7126110"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@adobe.com"
}