GitHub Advisoryadvisory · Packagist
GHSA-c45w-p293-7cv6 Magento 2 Community Edition XSS Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2019-7945
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-07-14
Affected packages
• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
Description
A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.
Related
Alias · CVE (1)
- CVE-2019-7945 A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7945 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7945.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7945.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7945.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web