-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists because user-controllable data (translation strings) is rendered directly into an HTML page without proper sanitization or escaping. The analysis of the patch commit 9d604f5489851c54a96fca31b0e13c414b0fb20a confirms this root cause. The primary file changed is app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php, which contains the render method. Before the patch, this method directly concatenated the output of Mage::helper('adminnotification')->__('...') into an HTML string. The __() function is for translation and does not perform escaping, making it a classic vector for stored XSS if the translation source can be manipulated. The patch explicitly adds $this->escapeHtml() and $this->escapeUrl() to the data before it is rendered, which directly mitigates the vulnerability. Therefore, the Mage_Adminhtml_Block_Notification_Grid_Renderer_Actions.render function is the precise location of the vulnerability, as it is the function responsible for generating the unsafe output that leads to XSS.
Mage_Adminhtml_Block_Notification_Grid_Renderer_Actions.renderapp/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmage/magento-lts | composer | < 20.16.0 | 20.16.0 |
Ongoing coverage of React2Shell