Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.

Remediation

References

CVE-2019-7866

Related Vulnerabilities

WordPress Plugin WP Debugging Security Bypass (2.10.2)

WordPress Plugin Shopping Cart & eCommerce Store Multiple Security Bypass Vulnerabilities (3.0.20)

Joomla Improper Input Validation Vulnerability (CVE-2015-8562)

IBM WebSEAL Improper Certificate Validation Vulnerability (CVE-2019-4150)

Ruby Out-of-bounds Write Vulnerability (CVE-2016-2338)

Severity

Medium

Classification

CVE-2019-7866 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities