Every CVESearch/Get API key

GHSA-gp6m-fq6h-cjcx

Magento LTS vulnerable to stored XSS in admin file form

5.4 MediumFix available

GHSA-gp6m-fq6h-cjcx is a medium vulnerability (CVSS 5.4) in openmage/magento-lts, published February 27, 2024. No source lists public exploit code. Fixed in openmage/magento-lts 20.5.0.

What does this mean?
Severity
5.4 MediumCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
20.5.0openmage/magento-lts +3 more

Description

Summary

OpenMage is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Details

Mage_Adminhtml_Block_System_Config_Form_Field_File does not escape filename value in certain situations. Same as: https://nvd.nist.gov/vuln/detail/CVE-2024-20717

PoC

  1. Create empty file with this filename: <img src=x onerror=alert(1)>.crt
  2. Go to System > Configuration > Sales | Payment Methonds.
  3. Click Configure on PayPal Express Checkout.
  4. Choose API Certificate from dropdown API Authentication Methods.
  5. Choose the XSS-file and click Save Config.
  6. Profit, alerts "1" -> XSS.
  7. Reload, alerts "1" -> Stored XSS.

Impact

Affects admins that have access to any fileupload field in admin in core or custom implementations. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
openmage/magento-lts
Packagist
20.0.0 up to 20.5.0
20.5.0
openmage/magento-lts
Packagist
before 19.5.3
19.5.3
openmage/magento-lts
Packagist
20.0.0 up to 20.5.0, plus listed versions
v20.0.0v20.0.1v20.0.10v20.0.11v20.0.12
Show 27 moreShow less
v20.0.13v20.0.14v20.0.15v20.0.16v20.0.17v20.0.18v20.0.19v20.0.2v20.0.20v20.0.3v20.0.4v20.0.5v20.0.6v20.0.7v20.0.8v20.1.0v20.1.0-rc1v20.1.0-rc2v20.1.0-rc3v20.1.0-rc4v20.1.0-rc5v20.1.0-rc6v20.1.0-rc7v20.1.1v20.2.0v20.3.0v20.4.0
20.5.0
openmage/magento-lts
Packagist
before 19.5.3, plus listed versions
1.9.1.11.9.2.01.9.2.11.9.2.21.9.2.3
Show 35 moreShow less
1.9.2.41.9.3.01.9.3.1v19.4.0v19.4.1v19.4.10v19.4.11v19.4.12v19.4.13v19.4.14v19.4.15v19.4.16v19.4.17v19.4.18v19.4.19v19.4.2v19.4.20v19.4.21v19.4.22v19.4.23v19.4.3v19.4.4v19.4.5v19.4.6v19.4.7v19.4.8v19.4.9v19.5.0v19.5.0-rc1v19.5.0-rc2v19.5.0-rc3v19.5.0-rc4v19.5.0-rc5v19.5.1v19.5.2
19.5.3

What each source reports

GitHub Advisories Score used5.4

Magento LTS vulnerable to stored XSS in admin file form

Summary

OpenMage is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Details

Mage_Adminhtml_Block_System_Config_Form_Field_File does not escape filename value in certain situations. Same as: https://nvd.nist.gov/vuln/detail/CVE-2024-20717

PoC

  1. Create empty file with this filename: <img src=x onerror=alert(1)>.crt
  2. Go to System > Configuration > Sales | Payment Methonds.
  3. Click Configure on PayPal Express Checkout.
  4. Choose API Certificate from dropdown API Authentication Methods.
  5. Choose the XSS-file and click Save Config.
  6. Profit, alerts "1" -> XSS.
  7. Reload, alerts "1" -> Stored XSS.

Impact

Affects admins that have access to any fileupload field in admin in core or custom implementations. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Record
GHSA-gp6m-fq6h-cjcx
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV5.4

Magento LTS vulnerable to stored XSS in admin file form

Summary

OpenMage is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.

Details

Mage_Adminhtml_Block_System_Config_Form_Field_File does not escape filename value in certain situations. Same as: https://nvd.nist.gov/vuln/detail/CVE-2024-20717

PoC

  1. Create empty file with this filename: <img src=x onerror=alert(1)>.crt
  2. Go to System > Configuration > Sales | Payment Methonds.
  3. Click Configure on PayPal Express Checkout.
  4. Choose API Certificate from dropdown API Authentication Methods.
  5. Choose the XSS-file and click Save Config.
  6. Profit, alerts "1" -> XSS.
  7. Reload, alerts "1" -> Stored XSS.

Impact

Affects admins that have access to any fileupload field in admin in core or custom implementations. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Record
GHSA-gp6m-fq6h-cjcx
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open