CVE-2021-21023

MEDIUM

Magento < 2.3.6 - Authenticated Stored Cross-Site Scripting in Admin Console

Title source: llm
STIX 2.1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

References (1)

Core 1
Core References

Scores

CVSS v3 4.8
EPSS 0.0378
EPSS Percentile 88.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (6)
magento/community-edition 0 - 2.3.6Packagist
magento/magento 2.3.6 (2 CPE variants)
magento/magento 2.4.0 (4 CPE variants)
magento/magento 2.4.1 (2 CPE variants)
magento/magento < 2.3.6 (2 CPE variants)
magento/project-community-edition 0Packagist
Published Feb 11, 2021
Tracked Since Feb 18, 2026