Vulnerability advisory

GHSA-9j5w-2cqc-cwj9

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

Published Dec 8, 2023Updated Dec 4, 2024OSV record ↗

Severity

Affected versions

Affected Fixed in

All versions before 20.2.0 20.2.0Advisories →

Affected	Fixed in
All versions before 20.2.0	`20.2.0`Advisories →
Also listed as affected (70) `1.9.1.1` `1.9.2.0` `1.9.2.1` `1.9.2.2` `1.9.2.3` `1.9.2.4` `1.9.3.0` `1.9.3.1` `v19.4.0` `v19.4.1` `v19.4.10` `v19.4.11` `v19.4.12` `v19.4.13` `v19.4.14` `v19.4.15` `v19.4.16` `v19.4.17` `v19.4.18` `v19.4.19` `v19.4.2` `v19.4.20` `v19.4.21` `v19.4.22` `v19.4.23` `v19.4.3` `v19.4.4` `v19.4.5` `v19.4.6` `v19.4.7` `v19.4.8` `v19.4.9` `v19.5.0` `v19.5.0-rc1` `v19.5.0-rc2` `v19.5.0-rc3` `v19.5.0-rc4` `v19.5.0-rc5` `v19.5.1` `v19.5.2` `v19.5.3` `v20.0.0` `v20.0.1` `v20.0.10` `v20.0.11` `v20.0.12` `v20.0.13` `v20.0.14` `v20.0.15` `v20.0.16` `v20.0.17` `v20.0.18` `v20.0.19` `v20.0.2` `v20.0.20` `v20.0.3` `v20.0.4` `v20.0.5` `v20.0.6` `v20.0.7` `v20.0.8` `v20.1.0` `v20.1.0-rc1` `v20.1.0-rc2` `v20.1.0-rc3` `v20.1.0-rc4` `v20.1.0-rc5` `v20.1.0-rc6` `v20.1.0-rc7` `v20.1.1`

Also listed as affected (70)

From HackerOne report #1948040 by Halit AKAYDIN (hltakydn)

What kind of vulnerability is it? Who is impacted?

The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags.

Has the problem been patched? What versions should users upgrade to?

This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220

Is there a way for users to fix or remediate the vulnerability without upgrading?

The WYSIWYG editor features could be disabled in the configuration. Possibly some WAF appliances would filter this attack.

Are there any links users can visit to find out more?

The attack is simply an exploit of the "onmouseover" attribute of an img element as described on OWASP XSS Filter Evasion