CVEvulnerability
CVE-2019-7877
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-08-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.
Affected configurations
• magento magento (>= 2.1.0 < 2.1.18)
• magento magento (>= 2.2.0 < 2.2.9)
• magento magento (>= 2.3.0 < 2.3.2)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 Not Applicable, Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 Not Applicable, Vendor Advisory