GHSA-59vf-hjxc-f9c5
Magento Open Source allows Cross-Site Scripting (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | 2.4.6 | no fix listed |
| Packagist | magento/community-edition | 2.4.5 | no fix listed |
| Packagist | magento/community-edition | 2.4.4 | no fix listed |
| Packagist | magento/community-edition | >= 2.4.7-beta1, < 2.4.7 | 2.4.7 |
| Packagist | magento/community-edition | >= 2.4.6-p1, < 2.4.6-p5 | 2.4.6-p5 |
| Packagist | magento/community-edition | >= 2.4.5-p1, < 2.4.5-p7 | 2.4.5-p7 |
| Packagist | magento/community-edition | >= 2.4.4-p1, < 2.4.4-p8 | 2.4.4-p8 |
| Packagist | magento/project-community-edition | <= 2.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Confidentiality and integrity are considered high due to having admin impact.
References
External links from the advisory. They lead to third-party sites.