Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies

2022-05-2419:06:25

Google

osv.dev

6.2 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.4%

JSON

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

CPENameOperatorVersion
magento/community-editioneq0.1.0-alpha97
magento/community-editioneq0.42.0-beta6
magento/community-editioneq2.0.18
magento/community-editioneq0.42.0-beta7
magento/community-editioneq2.4.0-p1
magento/community-editioneq0.1.0-alpha89
magento/community-editioneq2.1.18
magento/community-editioneq1.0.0-beta2
magento/community-editioneq2.2.7
magento/community-editioneq0.42.0-beta8

Name	Operator	Version
magento/community-edition	eq	0.1.0-alpha97
magento/community-edition	eq	0.42.0-beta6
magento/community-edition	eq	2.0.18
magento/community-edition	eq	0.42.0-beta7
magento/community-edition	eq	2.4.0-p1
magento/community-edition	eq	0.1.0-alpha89
magento/community-edition	eq	2.1.18
magento/community-edition	eq	1.0.0-beta2
magento/community-edition	eq	2.2.7
magento/community-edition	eq	0.42.0-beta8