Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases.
But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
References
| Link | Resource |
|---|---|
| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2 | Mitigation Vendor Advisory |
| https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948 | Issue Tracking |
Configurations
History
23 Aug 2024, 13:44
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openmage magento
Openmage |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
| References | () https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2 - Mitigation, Vendor Advisory | |
| References | () https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948 - Issue Tracking | |
| CPE | cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* | |
| CWE | CWE-79 |
29 Jul 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-29 15:15
Updated : 2024-08-23 13:44
NVD link : CVE-2024-41676
Mitre link : CVE-2024-41676
JSON object : View
Products Affected
openmage
- magento
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')