-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves stored XSS in marketing email templates, requiring both input handling and output rendering flaws. The Save controller action would process() user-supplied template content, and the Preview block would display it. Magento's patch notes indicate fixes in template handling mechanisms, and these components are central to the email template workflow. While exact commit diffs aren't available, the pattern matches Magento's architecture where template controllers handle raw input and preview blocks render content without contextual escaping.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3, < 2.3.2 | 2.3.2 |
Ongoing coverage of React2Shell