-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2-p1 | 2.3.2-p1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated API endpoint input during sale pickup event handling. The Save controller action for pickup locations is the logical point where this input would be processed. Magento's security bulletin (PRODSECBUG-2412) explicitly links the XSS to location name/API endpoint handling in sales pickup context. The function responsible for persisting this data without adequate sanitization would be the primary vulnerability point, consistent with the described attack vector.