OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload
Summary
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unaut...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| OpenMagemagento-lts |
≥ 21.0.0-beta1, < 21.0.0-beta3→ 21.0.0-beta3 |
21.0.0-beta3 |
Original description The description as published by the source.
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.
Source: CVE.org (CVE Program・cvelistV5) NVD