GitHub Advisoryadvisory · Packagist
GHSA-ff7r-7rrm-wx6w Magento 2 Community Edition XSS Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2019-7882
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-07-17
Affected packages
• Packagist magento/community-edition: >= 2.1, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3, < 2.3.2 → fixed in 2.3.2
Description
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
Related
Alias · CVE (1)
- CVE-2019-7882 A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7882 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7882.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7882.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7882.yaml web
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web