CVE-2024-41676 Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
Attackers can inject arbitrary JavaScript into admin system configs, potentially leading to code execution or account takeover in Magento LTS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41676?
CVE-2024-41676 is a medium-severity cross-site scripting vulnerability in OpenMage magento-lts, published on 29 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
Weakness: CWE-79
Which versions are affected by CVE-2024-41676?
2 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openmage/magento-lts Packagist | All versions | 20.10.1 |
openmage/magento-lts Packagist | All versions | 20.10.1 |
Products include Openmage Magento.
How do I fix CVE-2024-41676?
Upgrade openmage/magento-lts to 20.10.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-41676 being exploited?
There is no known exploitation of CVE-2024-41676 in the wild and no public exploit code.
Other vulnerabilities in OpenMage magento-lts
- CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper
- CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2
- CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update
- CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
- CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Sources
Also known as GHSA-5vrp-638w-p8m2.