Magento CMS Admin Panel HTML Injection Vulnerability

Bugtraq ID:	98792
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 31 2017 12:00AM
Updated:	May 31 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Magento Enterprise Edition 2.1.6 Magento Enterprise Edition 2.1.2 Magento Enterprise Edition 2.0.6 Magento Enterprise Edition 2.0.5 Magento Enterprise Edition 2.0.4 Magento Enterprise Edition 2.0.3 Magento Enterprise Edition 2.0.2 Magento Enterprise Edition 2.0.1 Magento Community Edition 2.0.6 Magento Community Edition 2.0.5 Magento Community Edition 2.0.4 Magento Community Edition 2.0.3 Magento Community Edition 2.0.2 Magento Community Edition 2.1.6 Magento Community Edition 2.0.1
Not Vulnerable:	Magento Enterprise Edition 2.1.7 Magento Enterprise Edition 2.0.14 Magento Community Edition 2.1.7 Magento Community Edition 2.0.14

Magento CMS Admin Panel HTML Injection Vulnerability

Magento CMS is prone to an HTML-injection vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following products are affected:

Versions prior to Magento Community Edition 2.0.14 and 2.1.7
Versions prior to Magento Enterprise Edition 2.0.14 and 2.1.7

Magento CMS Admin Panel HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.