PT-2025-9112 · Adobe · Magento

Justlife4X4 · Published 2025-02-28 · Updated 2025-06-16 · CVE-2025-27400

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.12.3 Magento Long Term Support (LTS) versions prior to 20.13.1

Description The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access.

Recommendations For versions prior to 20.12.3, update to version 20.12.3 to resolve the issue. For versions prior to 20.13.1, update to version 20.13.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27400

GHSA-5PXH-89CX-4668

Affected Products

Magento

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27400.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27400 · Security Note
• https://osv.dev/vulnerability/GHSA-5pxh-89cx-4668 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27400 · Vendor Advisory
• https://github.com/OpenMage/magento-lts · Note
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668 · Note
• https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3 · Note
• https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea · Note
• https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0 · Note
• https://t.me/cvenotify/125802 · Telegram Post
• https://twitter.com/cybercronai/status/1895527054424056212 · Twitter Post
• https://t.me/cvedetector/19174 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1895521156104396867 · Twitter Post
• https://twitter.com/CVEnew/status/1895619311777267882 · Twitter Post