CVE-2023-54423 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts before 20.2.0 has a stored cross-site scripting flaw because the TinyMCE WYSIWYG editor does not filter scripts in crafted HTML tags. An attacker can inject an img element with a malicious onmouseover attribute that runs script in the browsers of users who view the rendered content.
first public Dec 8, 2023 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores and sites running OpenMage magento-lts earlier than 20.2.0 that use the TinyMCE WYSIWYG editor to create or render content. Exposure comes from stored HTML that visitors' browsers render, so people who never use the editor are still exposed to content it stored. Installations on 20.2.0 or later are not affected by this flaw.
Not affected if no-tinymce-wysiwyg, version-20.2.0-or-later
Who cares magento-lts, openmage, php, self-hosted
20.2.020.2.0 or laterOpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.