What’s Vulnerable › Vulnerabilities

CVE-2024-56174

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-18 · updated 2026-06-17
• Weakness: CWE-79

Description

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.

Affected products

• Optimizely Configured Commerce: before 5.2.2408 — fixed in 5.2.2408

How to fix

Upgrade to a fixed version: Optimizely Configured Commerce 5.2.2408. Check the vendor advisory for mitigations.

References

• https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01

Get alerted when CVE-2024-56174 or the next vulnerability affects your stack