Composer JavaScript injection possible via html comments
Moderate severity
GitHub Reviewed
Published
Nov 12, 2019
to the GitHub Advisory Database
•
Updated Sep 6, 2023
Package
Affected versions
>= 2.2, < 2.2.10
>= 2.3, < 2.3.3
Patched versions
2.2.10
2.3.3
Description
Reviewed
Nov 12, 2019
Published to the GitHub Advisory Database
Nov 12, 2019
Last updated
Sep 6, 2023
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
References