Threats tagged 'ghsa-52fg-wjxm-pp44'

Magento Project Community Edition versions up to 2.4.7-p1 and certain earlier patched releases contain a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-39400). This flaw allows an authenticated admin user to inject and execute arbitrary JavaScript in another admin's browser session, potentially compromising confidentiality and integrity. Exploitation requires user interaction, such as clicking a malicious link. The vulnerability has been assigned a high severity score of 8.1 and is fixed in versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, and 2.4.4-p10.