PT-2025-9112

CVE-2025-27400

Publicado

2025-02-28

Atualizado

2025-06-16

Descrição por

CVSS 3.1

2.9

Baixa

MétricasAV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.12.3 Magento Long Term Support (LTS) versions prior to 20.13.1

Description The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access.

Recommendations For versions prior to 20.12.3, update to version 20.12.3 to resolve the issue. For versions prior to 20.13.1, update to version 20.13.1 to resolve the issue.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Justlife4X4

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Identificadores relacionados

CVE-2025-27400