Justlife4X4

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT NAME from the request path, executing script in the storefront origin within victims' browsers.

Name of the Vulnerable Software and Affected Versions Convoy versions 3.9.0-beta through 4.5.0 Description Convoy, a KVM server management panel, had a flaw in the JWTService::decode() method where the cryptographic signature of JWT tokens was not verified. The validation process lacked the SignedWith constraint, allowing attackers to forge or modify JWT token payloads, specifically the `user uuid` claim, without invalidating the token as long as time-based claims were valid. This impacted the SSO authentication flow, enabling an attacker to authenticate as any user by crafting a token with an arbitrary `user uuid`. Recommendations Update Convoy to version 4.5.1 or later.

The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access.

This issue affects the design/header/welcome, design/header/logo src, design/header/logo src small, and design/header/logo alt system configs, which are intended to enable admins to set a text or define an image URL. Due to previously missing escaping, it allowed input of arbitrary HTML and, as a consequence, arbitrary JavaScript. This could be an issue in scenarios where users work with more restrictive roles in the backend, potentially leading to unintended privilege escalation.