-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves reflected XSS in the admin panel when secret key protection is disabled. Analysis focused on: 1) Admin controllers handling URL parameters 2) Dashboard components displaying user-controlled data. The execute() method in admin controllers is the entry point for request processing, while dashboard blocks handle search term rendering. Both would appear in stack traces when malicious payloads are processed. Confidence is medium as we infer common vulnerability patterns since exact patch details aren't available, but these components align with the described attack vector and Magento's typical XSS mitigation patterns requiring escaping in controllers/blocks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |