« Volver al listado

CVE-2021-21023

Estado: ModificadaMedia (4.8)—

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Magento — Magento

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21023",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Magento Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.0-p1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.3.6"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "None"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-11T20:15:14.387",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting vulnerability in the admin console. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation."
    },
    {
      "lang": "es",
      "value": "Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son susceptibles a una vulnerabilidad de tipo cross-site scripting almacenado en la consola de administración. Una explotación con éxito podría conllevar a una ejecución arbitraria de JavaScript en el navegador de la víctima. Es requerido un acceso a la consola de administración para una explotación con éxito"
    }
  ],
  "lastModified": "2026-06-17T03:34:40.880",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14B6B496-E849-4935-B3D8-8BDB8DDD59A3",
              "versionEndExcluding": "2.3.6"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79C3A2B0-AE14-4D0F-BEE2-82FC00BE6087",
              "versionEndExcluding": "2.3.6"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9C60780-1213-4D06-A4C4-CC915C952B7B"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CCEDD72-7195-495C-A9B6-9D18BA9756F7"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05F799AA-CDC0-409F-BB7E-CB941D6FB189"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "600AA27A-D2A8-41C3-8631-74ECF7453E78"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67683B07-34CD-4DD2-A6C9-C71733007397"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECA32B69-E9D8-4C01-ACDC-E0F885D937FB"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80860D39-0D51-47B3-BA92-F473ADA1BBC3"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ADFE661-AB9C-4387-AC4F-D14A0717C2B8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}