CVE-2021-36027: Magento Commerce Stored Cross-site Scripting Vulnerability
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-36027.
What is the severity of CVE-2021-36027?
The severity of CVE-2021-36027 is medium with a CVSS score of 6.1.
Which versions of Magento Commerce are affected by CVE-2021-36027?
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by CVE-2021-36027.
What is the impact of CVE-2021-36027?
CVE-2021-36027 allows an attacker to inject malicious scripts into vulnerable form fields, which can lead to the execution of malicious JavaScript in a victim's browser.
Is there a fix for CVE-2021-36027?
Yes, a fix for CVE-2021-36027 is available. It is recommended to update Magento Commerce to the latest version to mitigate this vulnerability.