CVE-2021-21029

MEDIUM

Magento < 2.3.6-p1 - Authenticated Reflected Cross-Site Scripting via File Parameter

Title source: llm
STIX 2.1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

References (1)

Core 1
Core References

Scores

CVSS v3 4.8
EPSS 0.4350
EPSS Percentile 97.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (5)
magento/community-edition 0 - 2.3.6-p1Packagist
magento/magento 2.3.6 (2 CPE variants)
magento/magento 2.4.0 (4 CPE variants)
magento/magento 2.4.1 (2 CPE variants)
magento/magento < 2.3.6 (2 CPE variants)
Published Feb 11, 2021
Tracked Since Feb 18, 2026