GHSA-8578-mmf4-f327
Magento 2 Community Edition Cross-site Scripting Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2019-7873
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7873 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7873.yaml WEB
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |