Publish GHSA-5pxh-89cx-4668

advisories/github-reviewed/2025/03/GHSA-5pxh-89cx-4668/GHSA-5pxh-89cx-4668.json

@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5pxh-89cx-4668",
+  "modified": "2025-03-03T19:47:12Z",
+  "published": "2025-03-03T19:47:12Z",
+  "aliases": [
+    "CVE-2025-27400"
+  ],
+  "summary": "Magento LTS vulnerable to stored XSS in theme config fields",
+  "details": "As reported by [Aakash Adhikari](https://hackerone.com/dark_haxor), Github: @justlife4x4, the Design > Themes > Skin (Images / CSS) config field allows a Stored XSS when it contains an end script tag.\n\n### Impact\nA malicious user with access to this configuration field could use a Stored XSS to affect other authenticated admin users in the admin panel.\n\nThe attack requires an admin user with configuration access, so in practice, it is not very likely to be used for gaining elevated privileges, although it could theoretically be used to impersonate other users.\n\n![image](https://github.com/user-attachments/assets/fd5b8f31-bf0c-4e87-8b50-03c6c8428bed)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "openmage/magento-lts"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20.12.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27400"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenMage/magento-lts"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-03T19:47:12Z",
+    "nvd_published_at": "2025-02-28T16:15:40Z"
+  }
+}