CVE-2021-28556 — Cross-site Scripting in Magento

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
4.8MEDIUMNVD
CNA6.9
EPSS
23.9%
top 3.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
MagentoMagento Community-editionAdobe Magento Commerce+1 more
Timeline
PublishedJun 28
Latest updateMay 24

Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages4 packages

▶NVDmagento/magento2.4.0 — 2.4.2+1
▶Packagistmagento/community-edition2.4.0 — 2.4.2-p1+1
▶CVEListV5adobe/magento_commerceunspecified — 2.4.2+3

🔴Vulnerability Details

3
GHSA
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies↗2022-05-24
▶
OSV
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies↗2022-05-24
▶
CVEList
Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution↗2021-06-28
▶
CVE-2021-28556 — Cross-site Scripting in Magento | cvebase