CVE-2021-28556: Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Other sources
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.2-p1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-28556.
What is the severity of CVE-2021-28556?
The severity of CVE-2021-28556 is medium with a CVSS score of 4.8.
What is affected by CVE-2021-28556?
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28556.
What is the impact of CVE-2021-28556?
Successful exploitation of CVE-2021-28556 could lead to arbitrary JavaScript execution by an unauthenticated attacker.
How can I fix CVE-2021-28556?
To fix CVE-2021-28556, it is recommended to upgrade to the latest version of Magento. Patch updates are available for affected versions.