GHSA-985w-mqqp-7287
Magento 2 Community Edition XSS Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-8120
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.19 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.10 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.3 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-8120 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8120.yaml WEB
- https://github.com/magento/magento2 PACKAGE
- https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update WEB
- https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |