Description

An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.

Remediation

References

CVE-2019-7888

Related Vulnerabilities

WordPress Plugin Appointments Scheduler Cross-Site Scripting (1.5)

Drupal Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-2922)

Drupal Core 6.x Cross-Site Scripting (6.0 - 6.11)

MySQL Deserialization of Untrusted Data Vulnerability (CVE-2019-14540)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-9281)

Severity

Medium

Classification

CVE-2019-7888 CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities