Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.

Remediation

References

CVE-2019-7867

Related Vulnerabilities

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8398)

MongoDb Improper Input Validation Vulnerability (CVE-2019-2389)

WordPress Plugin BuddyPress Multiple SQL Injection Vulnerabilities (1.7.1)

WordPress Plugin qTranslate X Multiple Cross-Site Scripting Vulnerabilities (3.4.6.8)

WordPress Plugin WooCommerce Anti-Fraud Security Bypass (3.2)

Severity

Medium

Classification

CVE-2019-7867 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities