-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability involves stored XSS via product attribute storage, requiring privileges to modify attributes. The Save controller action is the primary entry point for processing attribute data. Historical Magento XSS vulnerabilities often stem from unsanitized input in admin controllers. The lack of output escaping in admin templates or input sanitization during attribute persistence would enable this exploit. The execute() method in the Save controller is the most logical point where unsanitized user input enters the system, matching the attack vector described.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
Ongoing coverage of React2Shell