magento/magento2 · Security
Magento stored cross-site scripting vulnerability
- GHSA ID
- GHSA-x2v2-2jhp-c5hv
- CVE ID
- CVE-2021-36027
- Severity
- medium
- Published
- Updated
Description
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')