CVE-2021-28556: Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2021-28556.

Q: What is the severity of CVE-2021-28556?

The severity of CVE-2021-28556 is medium with a CVSS score of 4.8.

Q: What is the impact of CVE-2021-28556?

Successful exploitation of CVE-2021-28556 could lead to arbitrary JavaScript execution by an unauthenticated attacker.

Q: How can I fix CVE-2021-28556?

To fix CVE-2021-28556, it is recommended to upgrade to the latest version of Magento. Patch updates are available for affected versions.

Published Jun 28, 2021

Updated

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.

Affected Software

7 affected componentsFixes available

composer/magento/project-community-edition<=2.0.2

composer/magento/community-edition<2.3.7

2.3.7

composer/magento/community-edition>=2.4.0<2.4.2-p1

2.4.2-p1

Magento Magento<2.3.7

Magento Magento>=2.4.0<=2.4.2

Event History

Jun 28, 2021

CVE Published

via MITRE·01:42 PM

Data Sourced

via MITRE·01:42 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Advisory Published

via GitHub·07:06 PM

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2021-28556.

What is the severity of CVE-2021-28556?

The severity of CVE-2021-28556 is medium with a CVSS score of 4.8.

What is affected by CVE-2021-28556?

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28556.

What is the impact of CVE-2021-28556?