GHSA-JWXH-WJ79-CCM6 Magento Reflected Cross-site Scripting vulnerability via 'file' parameter

🗓️ 24 May 2022 17:41:56Reported by GoogleType

osv🔗 osv.dev👁 16 Views

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are vulnerable to Reflected Cross-site Scripting via 'file' paramete

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the Magento Commerce software platform for developing and managing online stores stems from the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.	25 Mar 202100:00	–	bdu_fstec
Circl	CVE-2021-21029	11 Feb 202122:47	–	circl
CNNVD	Adobe Magento 跨站脚本漏洞	9 Feb 202100:00	–	cnnvd
CNVD	Adobe Magento Cross-Site Scripting Vulnerability (CNVD-2021-13918)	10 Feb 202100:00	–	cnvd
Check Point Advisories	Adobe Magento Commerce Reflected Cross Site Scripting (CVE-2021-21029)	22 Feb 202200:00	–	checkpoint_advisories
CVE	CVE-2021-21029	11 Feb 202119:29	–	cve
Cvelist	CVE-2021-21029 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution	11 Feb 202119:29	–	cvelist
Github Security Blog	Magento Reflected Cross-site Scripting vulnerability via 'file' parameter	24 May 202217:41	–	github
NVD	CVE-2021-21029	11 Feb 202120:15	–	nvd
OSV	BIT-MAGENTO-2021-21029 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution	6 Mar 202410:59	–	osv

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-21029
github	www.github.com/magento/magento2/commit/a2eb7e29ea92a8bbc86c3b6b81b59d8533088497
github	www.github.com/magento/magento2/commit/a349e022c9ae070e7da262021f9ef182105aa00b
github	www.github.com/magento/magento2
helpx	www.helpx.adobe.com/security/products/magento/apsb21-08.html

16 Feb 2024 08:05Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.14.8

EPSS0.84674