CVE-2024-41676 MEDIUM

CVE-2024-41676: Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Vendor Openmage
Product magento-lts
Weakness CWE-79 · XSS
Published July 29, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

4.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.

Key dates

02Disclosure timeline

July 29, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28569 WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-66698 WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability