Description

A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.

Remediation

References

CVE-2019-7863

Related Vulnerabilities

MySQL CVE-2019-2923 Vulnerability (CVE-2019-2923)

Sqlite NULL Pointer Dereference Vulnerability (CVE-2019-9937)

WordPress Plugin WP Customer Reviews Unspecified Vulnerability (3.0.7)

Python Numeric Errors Vulnerability (CVE-2008-2316)

Jboss EAP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2011-4610)

Severity

Medium

Classification

CVE-2019-7863 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities