GHSA-m3v2-r236-5xgq
Magento 2 Community Edition XSS Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-7862
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Description
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-7862 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7862.yaml WEB
- https://github.com/magento/magento2 PACKAGE
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |