Advisory details:
github_osv / GHSA-8gfq-m4cf-w975
| Advisory ID | github_osv/GHSA-8gfq-m4cf-w975 |
| Aliases |
CVE-2021-36026
|
| Summary | Magento stored cross-site scripting vulnerability in the customer address upload feature Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/magento/magento2 | ||
| apsb21-64.html | Advisory | https://helpx.adobe.com/security/products/magento/apsb21-64.html |
| CVE-2021-36026 | https://nvd.nist.gov/vuln/detail/CVE-2021-36026 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.