Magento vulnerable to stored XSS in theme config fields

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

magento-lts 跨站脚本漏洞

magento-lts是OpenMage开源的一个用于Magento CE官方版本的可靠替代品。 magento-lts 20.12.3之前版本和20.13.1之前版本存在跨站脚本漏洞，该漏洞源于管理面板存在脚本执行，可能导致跨站脚本。

N/A

N/A