GitHub Advisoryadvisory · Packagist

GHSA-88x2-cq34-5fwc Magento Open Source reflected Cross-Site Scripting (XSS) vulnerability

MEDIUM Published 2024-10-10 Modified 2024-10-11 Official page ↗
Aliases
CVE-2024-45123
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-10-11

Affected packages

• Packagist magento/community-edition: >= 2.4.7-beta1, < 2.4.7-p3 → fixed in 2.4.7-p3 • Packagist magento/community-edition: >= 2.4.6-p1, < 2.4.6-p8 → fixed in 2.4.6-p8 • Packagist magento/community-edition: >= 2.4.5-p1, < 2.4.5-p10 → fixed in 2.4.5-p10 • Packagist magento/community-edition: < 2.4.4-p11 → fixed in 2.4.4-p11 • Packagist magento/community-edition: 2.4.7 (no fix yet) • Packagist magento/community-edition: 2.4.6 (no fix yet) • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: 2.4.4 (no fix yet)

Description

Magento Open Source versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Related

Alias · CVE (1)

  • CVE-2024-45123 Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a reflected Cross-Site Scripting (XSS)… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References