-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3, < 2.3.2-p1 | 2.3.2-p2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper output escaping of user-controlled translated strings. The Signifyd Guarantee feature uses a translation key that can be overridden via the admin panel. When the translated message is retrieved (via __() or equivalent) and rendered in the template without proper escaping (e.g., using $escaper->escapeHtml), it allows XSS payloads to execute. The block method responsible for delivering the message to the template would be the logical point of failure. While exact code isn't available, Magento's translation architecture and the vulnerability description strongly suggest this pattern.
Ongoing coverage of React2Shell