CVE-2021-28556
moderate-risk
Published 2021-06-28
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is required for successful exploitation.
Do I need to act?
!
23.9% chance of exploitation in next 30 days
EPSS score — higher than 76% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.9/10
Medium
NETWORK
/ LOW complexity
Affected Vendors
References (2)
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-30.html
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-30.html
46
/ 100
moderate-risk
Severity
25/34 · High
Exploitability
14/34 · Moderate
Exposure
7/34 · Low