Magento 2
At a glance
- Source
- NVD
- EPSS
- EPSS 0.56 % · percentile 46 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.8 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-m3v2-r236-5xgq — Magento 2 Community Edition XSS Vulnerability
European references
- ENISA EUVD · EUVD-2022-4481
- GCVE · GCVE-0-2019-7862
CERT-FR advisories
- CERTFR-2019-AVI-295 — Multiples vulnérabilités dans les produits Magento · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*≥ 2.1.0 < 2.1.18cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*≥ 2.2.0 < 2.2.9cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*≥ 2.3.0 < 2.3.2
Affected products
| Product | Versions |
|---|---|
| Magento 2 | affected Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |