But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| OpenMage | magento-lts | affected |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-2272 | Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher. |
 Github GHSA |
GHSA-5vrp-638w-p8m2 | Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs |
Fri, 23 Aug 2024 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openmage
Openmage magento |
|
| CPEs | cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* | |
| Vendors & Products |
Openmage
Openmage magento |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T04:46:52.910Z
Reserved: 2024-07-18T15:21:47.486Z
Link: CVE-2024-41676
Vulnrichment
Updated: 2024-08-02T04:46:52.910Z
NVD
Status : Modified
Published: 2024-07-29T15:15:16.040
Modified: 2024-11-21T09:32:57.240
Link: CVE-2024-41676
Redhat
No data.
OpenCVE Enrichment
No data.