Description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2008-3977 Vulnerability (CVE-2008-3977)
WordPress Plugin Age Gate Unspecified Vulnerability (2.18.5)
WebLogic CVE-2020-14636 Vulnerability (CVE-2020-14636)
Craft CMS Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-30179)
Magento Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-5301)