{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27400", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-24T15:51:17.267Z", "datePublished": "2025-02-28T15:26:14.265Z", "dateUpdated": "2025-08-26T19:32:15.324Z"}, "containers": {"cna": {"title": "Magento vulnerable to stored XSS in theme config fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668"}, {"name": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea"}, {"name": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3"}, {"name": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0"}], "affected": [{"vendor": "OpenMage", "product": "magento-lts", "versions": [{"version": "< 20.12.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-16T14:31:59.238Z"}, "descriptions": [{"lang": "en", "value": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue."}], "source": {"advisory": "GHSA-5pxh-89cx-4668", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-28T15:41:48.315159Z", "id": "CVE-2025-27400", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-26T19:32:15.324Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-28T15:41:48.315159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-28T15:43:11.693Z"}}], "cna": {"title": "Magento vulnerable to stored XSS in theme config fields", "source": {"advisory": "GHSA-5pxh-89cx-4668", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OpenMage", "product": "magento-lts", "versions": [{"status": "affected", "version": "< 20.12.3"}]}], "references": [{"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668", "name": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea", "name": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3", "name": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0", "name": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-06-16T14:31:59.238Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27400", "state": "PUBLISHED", "dateUpdated": "2025-08-26T19:32:15.324Z", "dateReserved": "2025-02-24T15:51:17.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-02-28T15:26:14.265Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could lead to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access, so in practicality it is not very likely to be useful given that a user with this level of access is probably already a full admin. Versions 20.12.3 and 20.13.0 contain a patch for the issue."}, {"lang": "es", "value": "Magento Long Term Support (LTS) es un proyecto no oficial impulsado por la comunidad que ofrece una alternativa a la plataforma de comercio electr\u00f3nico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Las versiones anteriores a 20.12.3 y 20.13.1 contienen una vulnerabilidad que permite la ejecuci\u00f3n de scripts en el panel de administraci\u00f3n, lo que podr\u00eda provocar ataques de cross-site scripting contra usuarios administradores autenticados. El ataque requiere un usuario administrador con acceso a la configuraci\u00f3n, por lo que, en la pr\u00e1ctica, no es muy probable que sea \u00fatil dado que un usuario con este nivel de acceso probablemente ya sea un administrador completo. Las versiones 20.12.3 y 20.13.1 contienen un parche para el problema."}], "id": "CVE-2025-27400", "lastModified": "2025-08-26T20:15:38.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.4, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-02-28T16:15:40.237", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{}