Magento stored cross-site scripting (XSS) in the customer address upload feature

2022-05-2417:41:56

Google

osv.dev

magento

xss

customer address upload

versions 2.4.1

2.4.0-p1

2.3.6

vulnerability

javascript execution

exploitation

user interaction

security advisory

AI Score

5.6

Confidence

High

EPSS

0.002

Percentile

56.9%

JSON

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim’s browser. Exploitation of this issue requires user interaction.