GitHub Advisoryadvisory · Packagist

GHSA-89ch-hqf9-rgp3 Using JS libraries with known security vulnerabilities

HIGH Published 2019-11-12 Modified 2019-11-15 Official page ↗
Aliases
CVE-2019-8121
Ecosystem
Packagist
Packages
magento/community-edition, magento/product-community-edition
Severity
High
Reviewed
2019-11-12

Affected packages

• Packagist magento/community-edition: >= 2.2, < 2.2.10 → fixed in 2.2.10 • Packagist magento/community-edition: >= 2.3, < 2.3.3 → fixed in 2.3.3 • Packagist magento/product-community-edition: >= 2.2, < 2.2.10 → fixed in 2.2.10 • Packagist magento/product-community-edition: >= 2.3, < 2.3.2-p2 → fixed in 2.3.2-p2

Description

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.

Related

Alias · CVE (1)

  • CVE-2019-8121 An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. vulnerability

References