CVE-2024-56173

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56173
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from JavaScript in an SVG document.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:optimizely:configured_commerce:*:*:*:*:*:*:*:*
History

05 Jun 2025, 20:58

Type Values Removed Values Added
First Time Optimizely configured Commerce
Optimizely
CPE cpe:2.3:a:optimizely:configured_commerce:*:*:*:*:*:*:*:*
References () https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01 - () https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01 - Vendor Advisory
Summary
  • (es) En Optimizely Configured Commerce anterior a la versión 5.2.2408, se pueden almacenar payloads y posteriormente ejecutarlos en los navegadores de los usuarios bajo condiciones específicas: XSS desde JavaScript en un documento SVG.

18 Dec 2024, 16:15

Type Values Removed Values Added
CWE CWE-79
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7

18 Dec 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-18 06:15

Updated : 2025-06-05 20:58

NVD link : CVE-2024-56173

Mitre link : CVE-2024-56173

CVE.ORG link : CVE-2024-56173

JSON object : View

Products Affected

optimizely

  • configured_commerce
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')