PkgSeer

Vulnerability GHSA-9j5w-2cqc-cwj9

High Risk

2 years ago

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1

Summary

Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor

Details

From HackerOne report #1948040 by Halit AKAYDIN (hltakydn)

Impact

What kind of vulnerability is it? Who is impacted?

The TinyMCE WYSIWYG editor fails to filter scripts when rendering the HTML in specially crafted HTML tags.

Patches

Has the problem been patched? What versions should users upgrade to?

This vulnerability was fixed in version 20.2.0 by upgrading TinyMCE to a recent version in https://github.com/OpenMage/magento-lts/pull/3220

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The WYSIWYG editor features could be disabled in the configuration. Possibly some WAF appliances would filter this attack.

References

Are there any links users can visit to find out more?

The attack is simply an exploit of the "onmouseover" attribute of an img element as described on OWASP XSS Filter Evasion

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Magento LTS: Reflected XSS - Import -> Data Flow (profiles)

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1 and v20.2.0 and v20.3.0 and v20.4.0 and v20.5.0 and v20.6.0 and v20.7.0 and v20.8.0 and v20.9.0 and v20.10.0 and v20.10.1 and v20.10.2 and v20.11.0 and v20.12.0 and v20.12.1 and v20.12.2 and v20.12.3 and v20.13.0 and v20.14.0 and v20.15.0 and v20.16.0 and v20.17.0 GHSA-x8jv-q8j2-487c

Magento LTS Vulnerable to Open Redirect via Unvalidated `uenc` Parameter in `stockAction()`

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1 and v20.2.0 and v20.3.0 and v20.4.0 and v20.5.0 and v20.6.0 and v20.7.0 and v20.8.0 and v20.9.0 and v20.10.0 and v20.10.1 and v20.10.2 and v20.11.0 and v20.12.0 and v20.12.1 and v20.12.2 and v20.12.3 and v20.13.0 and v20.14.0 and v20.15.0 and v20.16.0 and v20.17.0 GHSA-qpgq-5g92-j5q8

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1 and v20.2.0 and v20.3.0 and v20.4.0 and v20.5.0 and v20.6.0 and v20.7.0 and v20.8.0 and v20.9.0 and v20.10.0 and v20.10.1 and v20.10.2 and v20.11.0 and v20.12.0 and v20.12.1 and v20.12.2 and v20.12.3 and v20.13.0 and v20.14.0 and v20.15.0 and v20.16.0 and v20.17.0 GHSA-2cwr-gcf9-pvxr

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1 and v20.2.0 and v20.3.0 and v20.4.0 and v20.5.0 and v20.6.0 and v20.7.0 and v20.8.0 and v20.9.0 and v20.10.0 and v20.10.1 and v20.10.2 and v20.11.0 and v20.12.0 and v20.12.1 and v20.12.2 and v20.12.3 and v20.13.0 and v20.14.0 and v20.15.0 and v20.16.0 GHSA-3j5q-7q7h-2hhv

OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure

1.9.1.1 and 1.9.2.0 and 1.9.2.1 and 1.9.2.2 and 1.9.2.3 and 1.9.2.4 and 1.9.3.0 and 1.9.3.1 and v19.4.0 and v19.4.1 and v19.4.2 and v19.4.3 and v19.4.4 and v19.4.5 and v19.4.6 and v19.4.7 and v19.4.8 and v19.4.9 and v19.4.10 and v19.4.11 and v19.4.12 and v19.4.13 and v19.4.14 and v19.4.15 and v19.4.16 and v19.4.17 and v19.4.18 and v19.4.19 and v19.4.20 and v19.4.21 and v19.4.22 and v19.4.23 and v19.5.0-rc1 and v19.5.0-rc2 and v19.5.0-rc3 and v19.5.0-rc4 and v19.5.0-rc5 and v19.5.0 and v19.5.1 and v19.5.2 and v19.5.3 and v20.0.0 and v20.0.1 and v20.0.2 and v20.0.3 and v20.0.4 and v20.0.5 and v20.0.6 and v20.0.7 and v20.0.8 and v20.0.10 and v20.0.11 and v20.0.12 and v20.0.13 and v20.0.14 and v20.0.15 and v20.0.16 and v20.0.17 and v20.0.18 and v20.0.19 and v20.0.20 and v20.1.0-rc1 and v20.1.0-rc2 and v20.1.0-rc3 and v20.1.0-rc4 and v20.1.0-rc5 and v20.1.0-rc6 and v20.1.0-rc7 and v20.1.0 and v20.1.1 and v20.2.0 and v20.3.0 and v20.4.0 and v20.5.0 and v20.6.0 and v20.7.0 and v20.8.0 and v20.9.0 and v20.10.0 and v20.10.1 and v20.10.2 and v20.11.0 and v20.12.0 and v20.12.1 and v20.12.2 and v20.12.3 and v20.13.0 and v20.14.0 and v20.15.0 and v20.16.0 GHSA-665x-ppc4-685w

View all vulnerabilities for these packages

Impacted packages

openmage/magento-lts

Timeline

Published

2 years ago

Fixed (20.2.0)

3 years ago

Last Modified

15 hours ago