What is GHSA-jxjc-6xmh-h7mg?

GHSA-jxjc-6xmh-h7mg is a security advisory published by GitHub Security Advisories with Medium severity. Magento 2 Community Edition XSS Vulnerability

Which CVE IDs does GHSA-jxjc-6xmh-h7mg cover?

GHSA-jxjc-6xmh-h7mg covers the following CVE IDs: CVE-2020-24408. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jxjc-6xmh-h7mg?

GHSA-jxjc-6xmh-h7mg has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-jxjc-6xmh-h7mg?

GHSA-jxjc-6xmh-h7mg affects 1 product, including: composer/magento/community-edition:\u003c= 2.4.0.

GHSA-jxjc-6xmh-h7mgMediumCVSS 6.1

Magento 2 Community Edition XSS Vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 7, 2023

🔗 CVE IDs covered (1)

CVE-2020-24408 →

📋 Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

🎯 Affected products1

composer/magento/community-edition:<= 2.4.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-24408
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://github.com/advisories/GHSA-jxjc-6xmh-h7mg