GHSA-jwxh-wj79-ccm6

Magento Reflected Cross-site Scripting vulnerability via 'file' parameter

En bref

Publiée: 2022-05-24 17:41 UTC
Mise à jour: 2024-02-16 08:05 UTC
CVE: CVE-2021-21029
Alias: BIT-magento-2021-21029
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

Paquets affectés

Paquet	Versions
Packagist · magento/community-edition	introduced 0, fixed 2.3.6-p1
Packagist · magento/community-edition	introduced 2.4.0, fixed 2.4.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2021-21029 ADVISORY
https://github.com/magento/magento2/commit/a2eb7e29ea92a8bbc86c3b6b81b59d8533088497 WEB
https://github.com/magento/magento2/commit/a349e022c9ae070e7da262021f9ef182105aa00b WEB
https://github.com/magento/magento2 PACKAGE
https://helpx.adobe.com/security/products/magento/apsb21-08.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database