OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in…
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- OpenMage
- Product
- magento-lts
- CVSS v3.1
- 7.5 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
- Weakness
- CWE-82
- NVD status
- Received
Why it ranks 25 (Notable)
- CVSS v3.1 7.5 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2023-54423 on this site · NVD · CVE.org · Vulnpedia