Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

Remediation

References

CVE-2020-24408

Related Vulnerabilities

MySQL CVE-2013-1506 Vulnerability (CVE-2013-1506)

MyBB Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-3071)

WordPress Plugin BSK PDF Manager SQL Injection (3.1.1)

Oracle Database Server CVE-2005-4884 Vulnerability (CVE-2005-4884)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-25476)

Severity

Medium

Classification

CVE-2020-24408 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities