During customer registration on the storefront, a user could provide a user name that contained JavaScript code. Magento did not properly validate this name and executed it in the Admin context when editing the user in the backend. This JavaScript code could potentially steal the administrator session or act on behalf of a store administrator.

Part of patch MAGENTO 2.0.1 SECURITY UPDATE

This vulnerability affects the following application versions:

  • Magento 2.0.0
  • Magento 2.0.0-rc
  • Magento 2.0.0-rc2

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *