Log in Start free

Vulnerability · Published Feb 28, 2025 · Assigned by GitHub_M

CVE-2025-27400Magento vulnerable to stored XSS in theme config fields

Low 2.9

In plain English

A low-severity cross-site scripting in magento-lts from OpenMage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.3%top 82.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistopenmage/magento-lts20.12.3GHSA-5pxh-89cx-4668

Affected products (as reported)

VendorProductVersions
OpenMage magento-lts < 20.12.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

References