CVE-2024-20717

Stored admin XSS via PayPal authentication certificate. Older Magento and OpenMage versions prior to 19.5.3 are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Details

Mage_Adminhtml_Block_System_Config_Form_Field_File does not escape filename value in certain situations.