Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.

Remediation

References

CVE-2019-7866

Related Vulnerabilities

Dot CMS Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-12309)

WordPress Plugin Afterpay Gateway for WooCommerce Cross-Site Scripting (3.2.0)

WordPress Plugin Wise Chat Open Redirect (2.6.3)

Python Integer Overflow or Wraparound Vulnerability (CVE-2017-1000158)

WordPress Plugin DVS Custom Notification Multiple Cross-Site Request Forgery Vulnerabilities (1.0.1)

Severity

Medium

Classification

CVE-2019-7866 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities