CVE-2024-20759: Magento Open Source allows Cross-Site Scripting (XSS)
8.1
Basic Information
PHPTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | = 2.4.6 | |
| magento/community-edition | composer | = 2.4.5 | |
| magento/community-edition | composer | = 2.4.4 | |
| magento/community-edition | composer | >= 2.4.7-beta1, <= 2.4.7-beta3 | 2.4.7 |
| magento/community-edition | composer | >= 2.4.6-p1, < 2.4.6-p5 | 2.4.6-p5 |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p7 | 2.4.5-p7 |
| magento/community-edition | composer | >= 2.4.4-p1, < 2.4.4-p8 | 2.4.4-p8 |
| magento/project-community-edition | composer | <= 2.0.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The provided vulnerability information lacks specific technical details about implementation flaws, commit diffs, or patch comparisons. While the XSS vulnerability clearly stems from improper input sanitization in admin-accessible form fields (CWE-79), Magento's architecture involves multiple layers of abstraction (controllers, view models, templates, UI components) where the vulnerability could manifest. Without concrete evidence from code changes or official patch details, we cannot confidently identify specific functions. The vulnerability likely exists in template rendering logic or form data handling components that omit proper escaping (e.g., missing escapeHtml calls in .phtml templates), but these are educated guesses rather than confirmed targets.