PT-2025-9112 · Adobe · Magento

Justlife4X4 · Publicado 2025-02-28 · Atualizado 2025-06-16 · CVE-2025-27400

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Baixa

Vetor base

AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.12.3 Magento Long Term Support (LTS) versions prior to 20.13.1

Description The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access.

Recommendations For versions prior to 20.12.3, update to version 20.12.3 to resolve the issue. For versions prior to 20.13.1, update to version 20.13.1 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-27400

GHSA-5PXH-89CX-4668

Produtos afetados

Magento

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27400.json · Exploit
• https://github.com/OpenMage/magento-lts · Nota
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668 · Nota
• https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3 · Nota
• https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea · Nota
• https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0 · Nota
• https://t.me/cvenotify/125802 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1895527054424056212 · Publicação no Twitter
• https://t.me/cvedetector/19174 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1895521156104396867 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-27400 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5pxh-89cx-4668 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1895619311777267882 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27400 · Aviso do Fabricante