CVE-2021-36026: Magento Commerce Stored Cross-site Scripting Vulnerability
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-36026?
CVE-2021-36026 is a vulnerability in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) that allows an attacker to inject malicious scripts into vulnerable form fields using a stored cross-site scripting (XSS) attack.
How does CVE-2021-36026 affect Adobe Adobe Commerce?
Adobe Adobe Commerce versions between 2.3.0 and 2.3.7 are affected by CVE-2021-36026.
How does CVE-2021-36026 affect Adobe Magento Open Source?
Adobe Magento Open Source versions between 2.3.0 and 2.3.7 are affected by CVE-2021-36026.
How do I fix CVE-2021-36026?
To fix CVE-2021-36026, update Magento Commerce to version 2.4.2-p1 or later if you are using version 2.4.2, or update to version 2.3.8 or later if you are using version 2.3.x.
What is the severity of CVE-2021-36026?
CVE-2021-36026 has a severity rating of medium (6.1) according to the Common Vulnerability Scoring System (CVSS).