medium4.8
CVE-2019-7867
Magento 2 Community Edition XSS Vulnerability
Impact
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | magento/community-edition | >= 2.1.0, < 2.1.18 | 2.1.18 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magento | Magento | from 2.1.0 before 2.1.18 from 2.2.0 before 2.2.9 from 2.3.0 before 2.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://github.com/advisories/GHSA-vx2g-f45p-j674
- https://nvd.nist.gov/vuln/detail/CVE-2019-7867
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7867.yaml