Vulnerability advisory

GHSA-52fg-wjxm-pp44

Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Published Aug 14, 2024Updated Nov 6, 2025OSV record ↗

Also known as CVE-2024-39400

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Affected versions

magento/project-community-edition Packagist

All magento/project-community-edition advisories →

Affected Fixed in

All versions through 2.0.2 No fix listed

Affected	Fixed in
All versions through `2.0.2`	No fix listed
Also listed as affected (53) `0.1.0-alpha100` `0.1.0-alpha101` `0.1.0-alpha102` `0.1.0-alpha103` `0.1.0-alpha104` `0.1.0-alpha105` `0.1.0-alpha106` `0.1.0-alpha107` `0.1.0-alpha108` `0.1.0-alpha89` `0.1.0-alpha90` `0.1.0-alpha91` `0.1.0-alpha92` `0.1.0-alpha93` `0.1.0-alpha94` `0.1.0-alpha95` `0.1.0-alpha96` `0.1.0-alpha97` `0.1.0-alpha98` `0.1.0-alpha99` `0.42.0-beta1` `0.42.0-beta10` `0.42.0-beta11` `0.42.0-beta2` `0.42.0-beta3` `0.42.0-beta4` `0.42.0-beta5` `0.42.0-beta6` `0.42.0-beta7` `0.42.0-beta8` `0.42.0-beta9` `0.74.0-beta1` `0.74.0-beta10` `0.74.0-beta11` `0.74.0-beta12` `0.74.0-beta13` `0.74.0-beta14` `0.74.0-beta15` `0.74.0-beta16` `0.74.0-beta2` `0.74.0-beta3` `0.74.0-beta4` `0.74.0-beta5` `0.74.0-beta6` `0.74.0-beta7` `0.74.0-beta8` `0.74.0-beta9` `1.0.0-beta` `2.0.0` `2.0.0-rc` `2.0.0-rc2` `2.0.1` `2.0.2`

Also listed as affected (53)

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.4.7-beta1` to before 2.4.7-p2	`2.4.7-p2`Advisories →
Also listed as affected (5) `2.4.7` `2.4.7-beta1` `2.4.7-beta2` `2.4.7-beta3` `2.4.7-p1`
`2.4.6-p1` to before 2.4.6-p7	`2.4.6-p7`Advisories →
Also listed as affected (6) `2.4.6-p1` `2.4.6-p2` `2.4.6-p3` `2.4.6-p4` `2.4.6-p5` `2.4.6-p6`
`2.4.5-p1` to before 2.4.5-p9	`2.4.5-p9`Advisories →
Also listed as affected (8) `2.4.5-p1` `2.4.5-p2` `2.4.5-p3` `2.4.5-p4` `2.4.5-p5` `2.4.5-p6` `2.4.5-p7` `2.4.5-p8`
`2.4.4-p1` to before 2.4.4-p10	`2.4.4-p10`Advisories →
Also listed as affected (9) `2.4.4-p1` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9`
Affected versions (1) `2.4.7`
Affected versions (1) `2.4.6`
Affected versions (1) `2.4.5`
Affected versions (1) `2.4.4`

Description

Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.

GHSA-52fg-wjxm-pp44

Affected versions

magento/project-community-edition Packagist

magento/community-edition Packagist

Description

References