CVE-2021-21030: 
PHP vulnerability analysis and mitigation

A stored cross-site scripting (XSS) vulnerability was identified in Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3.6 (and earlier), specifically affecting the customer address upload feature. The vulnerability was assigned CVE-2021-21030 and was disclosed on December 18, 2020. This security flaw affects both Magento Commerce and Open Source editions (NVD, CVE).

The vulnerability is classified as a stored cross-site scripting (XSS) issue (CWE-79) that affects the customer address upload functionality. The severity assessment includes a CVSS 3.0 Base Score of 8.1 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, and a CVSS 2.0 Base Score of 4.3 (MEDIUM) with the vector string (AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

Successful exploitation of this vulnerability could lead to arbitrary JavaScript execution in the victim's browser. The vulnerability requires user interaction for successful exploitation, potentially allowing attackers to perform actions with the privileges of the affected user (NVD).

The vulnerability requires user interaction for successful exploitation. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) (NVD).

Adobe has released security updates to address this vulnerability. Users should upgrade to the latest version of Magento that is not affected by this vulnerability (Adobe Advisory).