-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies blockDirective() as the abused function. In Magento's architecture, CMS template filtering (including block directives) is handled by Magento\Cms\Model\Template\Filter. The function's role in processing unescaped user-supplied block directives aligns with the XSS vulnerability mechanism described. The patch likely added proper output sanitization in this directive handler.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3, < 2.3.2-p2 | 2.3.2-p2 |
KEV Misses 88% of Exploited CVEs- Get the report