CVE-2024-41676mediumCWE-79

CVE-2024-41676: fallo de gravedad media en OpenMage magento-lts

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear magento-lts+ Monitorear openmage/magento-lts

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.1epss 0.4%
Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
Productos afectados
OpenMage · magento-lts
CVEs relacionadas — OpenMage magento-lts

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-26285HIGHWidget instances allows a hacker to inject an executable file on the server on OpenMageEPSS 3.7%CVE-2020-26295HIGHCMS Editor code executionEPSS 2.2%CVE-2020-26252HIGHLayout XML RCE Vulnerability in OpenMageEPSS 2.1%CVE-2021-32758HIGHLayout XML Arbitrary Code FixEPSS 2.0%CVE-2021-32759HIGHData Flow Sanitation Issue FixEPSS 1.8%CVE-2021-39217HIGHOpenMage LTS arbitrary command execution in custom layout update through blocksEPSS 1.4%