CVE-2024-41676 json
Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs
published 2024-07-29 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2272 , GHSA-5vrp-638w-p8m2
- cvss
- 4.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, design/header/logo_src, design/header/logo_src_small, and design/header/logo_alt system configs.They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously missing escaping allowed to input arbitrary html and as a consequence also arbitrary JavaScript. The problem is patched with Version 20.10.1 or higher.
Patch / fix
- packagist openmage/magento-lts 20.10.1
- openmage magento 20.10.1
- openmage openmage 20.10.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N |
| GitHub | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | openmage/magento-lts | <20.10.1 |
20.10.1 |
Affected products
- OpenMage magento-lts
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/OpenMage/magento-lts/commit/484cf8afc550e98bbf2c03fbb29a8450a32e7948
web, issue-tracking
-
github.com
/OpenMage/magento-lts/security/advisories/GHSA-5vrp-638w-p8m2
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-41676
advisory
-
github.com
/OpenMage/magento-lts
package
Sources
- CVE List CVE-2024-41676
- GitHub Advisory GHSA-5vrp-638w-p8m2
- NVD CVE-2024-41676
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.