« Volver al listado

CVE-2021-21030

Estado: ModificadaAlta (8.1)—

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Magento — Magento

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Magento Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.0-p1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.3.6"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "None"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-11T20:15:14.827",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction."
    },
    {
      "lang": "es",
      "value": "Magento versiones 2.4.1 (y anteriores), versiones 2.4.0-p1 (y anteriores) y versiones 2.3.6 (y anteriores), son vulnerables a un ataque de tipo cross-site scripting (XSS) almacenado en la funcionalidad de carga de la dirección del cliente. Una explotación con éxito podría conllevar a una ejecución arbitraria de JavaScript en el navegador de la víctima. Una explotación de este problema requiere una interacción del usuario"
    }
  ],
  "lastModified": "2026-06-17T03:34:41.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14B6B496-E849-4935-B3D8-8BDB8DDD59A3",
              "versionEndExcluding": "2.3.6"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79C3A2B0-AE14-4D0F-BEE2-82FC00BE6087",
              "versionEndExcluding": "2.3.6"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9C60780-1213-4D06-A4C4-CC915C952B7B"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CCEDD72-7195-495C-A9B6-9D18BA9756F7"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05F799AA-CDC0-409F-BB7E-CB941D6FB189"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "600AA27A-D2A8-41C3-8631-74ECF7453E78"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67683B07-34CD-4DD2-A6C9-C71733007397"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECA32B69-E9D8-4C01-ACDC-E0F885D937FB"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80860D39-0D51-47B3-BA92-F473ADA1BBC3"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ADFE661-AB9C-4387-AC4F-D14A0717C2B8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}