CVE-2020-24408: Stored XSS in customer address upload feature
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-24408?
CVE-2020-24408 is a persistent XSS vulnerability in Magento versions 2.4.0 and 2.3.5p1 (and earlier) that allows users to upload malicious JavaScript via the file upload component.
How does CVE-2020-24408 affect Magento?
CVE-2020-24408 affects Magento versions 2.4.0 and 2.3.5p1 (and earlier) and allows an unauthenticated attacker to execute XSS attacks against other Magento users.
What is the severity of CVE-2020-24408?
The severity of CVE-2020-24408 is medium with a CVSS score of 6.1.
How can I fix CVE-2020-24408?
To fix CVE-2020-24408, you should upgrade Magento to version 2.4.1 or apply the necessary security patches.
What is the Common Weakness Enumeration (CWE) for CVE-2020-24408?
The CWE for CVE-2020-24408 is CWE-79, which is a category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').