CVE-2021-21029: medium-severity vulnerability in Adobe Magento Commerce
Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Magento allows an attacker with admin access to inject malicious code into a URL parameter, which runs in a visitor's browser when they click the link. This can steal sensitive information or perform unwanted actions.
Reflected XSS vulnerability in the 'file' parameter affecting Magento 2.4.1, 2.4.0-p1, and 2.3.6 or earlier. Exploitation requires admin-level access to craft the malicious payload; the attack vector is a crafted URL that executes arbitrary JavaScript in the victim's browser context.
In the same product, most dangerous first.