-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a reflected XSS in the Product widget chooser, which implies improper sanitization of user input during rendering. Magento's widget system uses controllers to handle parameters and blocks/templates to render UI components. The Chooser controller's execute method is the entry point for processing widget parameters, and the associated block's _toHtml method is responsible for generating HTML. Without proper escaping in these components, user-supplied input (e.g., from URL parameters) would be reflected in the admin panel. The high confidence for the controller stems from its role in handling raw input, while the block/template has medium confidence due to inferred lack of escaping without direct patch evidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
PHPPHP