Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | < 20.18.2, 21.0.0-beta1 – < 21.0.0-beta3 | 20.18.2 |
References
- GitHub Security Advisory (GHSA-hfqq-c3qm-38x8) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup third-party-advisory