CVE-2021-21023: Magento stored cross-site scripting vulnerability in the admin console
Magento stored cross-site scripting vulnerability in the admin console
Other sources
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.1-p1 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.6
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-21023.
What is the severity of CVE-2021-21023?
CVE-2021-21023 has a severity value of 4.8, which is considered medium.
How can this vulnerability be exploited?
This vulnerability can be exploited by executing arbitrary JavaScript in the victim's browser through a stored cross-site scripting attack on the Magento admin console.
Which versions of Magento are affected by CVE-2021-21023?
Versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3.6 (and earlier) of Magento are affected by CVE-2021-21023.
Is access to the admin console required for exploitation?
Yes, access to the admin console is required for exploitation of CVE-2021-21023.