CVE-2021-21029CWE-79

Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

Medium · published February 11, 2021

Patch now

High probability of exploitation

CVSS calls it medium at 4.8. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1
4.8
EPSS
85%
Percentile
99.7
In the wild
Unconfirmed
What it is

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.84641 · 99.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-02-11T19:29Z
EPSS history
Timeline
  • 11 FEB 19:29Z
    Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
    cvelistv5