Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.

Remediation

References

CVE-2021-21030

Related Vulnerabilities

Apache Tomcat Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2019-0232)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-16946)

Joomla! Core 1.0.x Unspecified Vulnerability (1.0.0 - 1.0.3)

Jenkins Improper Handling of Inconsistent Structural Elements Vulnerability (CVE-2021-21640)

WordPress Plugin Responsive Filterable Portfolio Unspecified Vulnerability (1.0.8)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2021-21030