From b9167a01f7dd0bb105c6d5abf0862b9a2d7a4f02 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 3 Mar 2025 19:48:47 +0000
Subject: [PATCH] Publish GHSA-5pxh-89cx-4668

---
 .../GHSA-5pxh-89cx-4668.json                  | 73 +++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-5pxh-89cx-4668/GHSA-5pxh-89cx-4668.json

diff --git a/advisories/github-reviewed/2025/03/GHSA-5pxh-89cx-4668/GHSA-5pxh-89cx-4668.json b/advisories/github-reviewed/2025/03/GHSA-5pxh-89cx-4668/GHSA-5pxh-89cx-4668.json
new file mode 100644
index 00000000000..0962bc18a6f
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-5pxh-89cx-4668/GHSA-5pxh-89cx-4668.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5pxh-89cx-4668",
+  "modified": "2025-03-03T19:47:12Z",
+  "published": "2025-03-03T19:47:12Z",
+  "aliases": [
+    "CVE-2025-27400"
+  ],
+  "summary": "Magento LTS vulnerable to stored XSS in theme config fields",
+  "details": "As reported by [Aakash Adhikari](https://hackerone.com/dark_haxor), Github: @justlife4x4, the Design > Themes > Skin (Images / CSS) config field allows a Stored XSS when it contains an end script tag.\n\n### Impact\nA malicious user with access to this configuration field could use a Stored XSS to affect other authenticated admin users in the admin panel.\n\nThe attack requires an admin user with configuration access, so in practice, it is not very likely to be used for gaining elevated privileges, although it could theoretically be used to impersonate other users.\n\n![image](https://github.com/user-attachments/assets/fd5b8f31-bf0c-4e87-8b50-03c6c8428bed)",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "openmage/magento-lts"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "20.12.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5pxh-89cx-4668"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27400"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/commit/d307e5bf75729a2347dde0952fe9fd9fcd9c6aea"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/OpenMage/magento-lts"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.12.3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.13.0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-03T19:47:12Z",
+    "nvd_published_at": "2025-02-28T16:15:40Z"
+  }
+}
\ No newline at end of file