-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized handling of payment method titles during configuration and rendering. Magento's payment method configuration flow involves saving user-provided titles (via admin controllers) and displaying them in multiple contexts. The AbstractMethod::getTitle() is a core method for retrieving payment titles, and Container::setMethodForm is a key rendering point. The absence of output escaping in these critical points (as implied by the XSS nature) makes them likely candidates. Confidence is high for the rendering function due to XSS patterns, and medium for the getter due to lack of explicit patch details.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2-p1 | 2.3.2-p1 |
A Semantic Attack on Google Gemini - Read the Latest Research