GHSA-j49x-jjmj-9fqj
Magento XSS Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/core | < 1.9.4.3 | 1.9.4.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.
References
External links from the advisory. They lead to third-party sites.