Threats tagged 'ghsa-22hr-pg7v-x6hx'

OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain admin page variables are rendered without proper escaping, allowing an attacker with limited admin access to inject malicious scripts. These scripts execute when another administrator accesses the affected pages, potentially allowing theft of form keys and unauthorized actions with that administrator's privileges.