PT-2024-29501 · Adobe · Magento

Justlife4X4 · Published 2024-07-29 · Updated 2024-08-23 · CVE-2024-41676

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Magento-lts versions prior to 20.10.1

Description This issue affects the design/header/welcome, design/header/logo src, design/header/logo src small, and design/header/logo alt system configs, which are intended to enable admins to set a text or define an image URL. Due to previously missing escaping, it allowed input of arbitrary HTML and, as a consequence, arbitrary JavaScript. This could be an issue in scenarios where users work with more restrictive roles in the backend, potentially leading to unintended privilege escalation.

Recommendations For versions prior to 20.10.1, upgrade to Version 20.10.1 or higher to patch the issue. As a temporary workaround, consider restricting access to the System Configs. Check templates where these settings are used to apply proper HTML filtering. For users relying on the ability to use HTML in these settings, restore the previous behavior by using the new introduced ->getUnescapedValue() method on escaped elements, and review the newly introduced Mage Core Model Security HtmlEscapedString.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41676

GHSA-5VRP-638W-P8M2

Affected Products

Magento

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41676.json · Exploit
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41676 · Security Note
• https://osv.dev/vulnerability/GHSA-5vrp-638w-p8m2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41676 · Vendor Advisory
• https://github.com/OpenMage/magento-lts · Note
• https://github.com/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948 · Note
• https://t.me/cvedetector/1852 · Telegram Post
• https://t.me/cvenotify/91876 · Telegram Post