GHSA-mcfc-67vm-j568 Magento Cross-Site Scripting (XSS) vulnerability
Attackers can inject malicious scripts into Magento pages, potentially stealing user data or hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-mcfc-67vm-j568?
GHSA-mcfc-67vm-j568 is a cross-site scripting vulnerability in magento/community-edition, published on 15 May 2024. It can be exploited over the network, and only if a user opens a file or follows a link.
Official description
Which versions are affected by GHSA-mcfc-67vm-j568?
4 open source packages ship an affected version, including magento/community-edition.
| Package | Affected | Fixed in |
|---|---|---|
magento/community-edition Packagist | From 2.1 | 2.1.15 |
magento/community-edition Packagist | From 2.1 | 2.1.15 |
magento/community-edition Packagist | From 2.2 | 2.2.6 |
magento/community-edition Packagist | From 2.2 | 2.2.6 |
How do I fix GHSA-mcfc-67vm-j568?
Upgrade magento/community-edition to a fixed version for your release line: 2.1.15 or 2.2.6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-mcfc-67vm-j568 being exploited?
There is no known exploitation of GHSA-mcfc-67vm-j568 in the wild and no public exploit code.