During customer registration on the storefront, a malicious user could provide a user name that contained JavaScript code. Magento did not properly validate this name, and the JavaScript could be executed in Admin context when an administrator added the user in the backend or ran a Reviews report. This code could steal the Administrator session or act on behalf of store administrator. This issue was partially fixed in Magento CE and EE 2.0.1, but additional cases were discovered and fixed.
MAGENTO 2.0.4 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2