Vulnerability advisory

BIT-magento-2020-24408

Stored XSS in customer address upload feature

Published Mar 6, 2024Updated Sep 8, 2026OSV record ↗

Also known as CVE-2020-24408GHSA-jxjc-6xmh-h7mg

Severity

Severity not reported.

Affected versions

magento Bitnami

Affected Fixed in

All versions before 2.3.6 2.3.6

2.4.0 to before 2.4.1 2.4.1

Affected	Fixed in
All versions before 2.3.6	`2.3.6`
`2.4.0` to before 2.4.1	`2.4.1`
Severity for this package CVSS 3.x`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Severity for this package

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗
Webnvd.nist.gov/vuln/detail/CVE-2020-24408 ↗