-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a stored XSS in the admin tax rule management interface. The primary vector involves improper output escaping in grid rendering (_prepareColumns) and potential lack of input sanitization in the save controller. Magento's grid components often use 'escape' flags for columns, and missing this flag for user-controlled fields would cause XSS. The controller's execute method is a plausible candidate for insufficient input validation, though the exact mechanism is less certain without patch details. The high confidence in _prepareColumns stems from Magento's typical XSS fixes involving grid column escaping.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
PHPPHPOngoing coverage of React2Shell