Description

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address.

Remediation

References

CVE-2019-8120

Related Vulnerabilities

WordPress Plugin WordPress Social Stream Security Bypass (1.5.15)

Apache Tomcat Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2016-9774)

WordPress Plugin Email Users Cross-Site Scripting (4.8.2)

WordPress Plugin WP CSS 'wp-css-compress.php' Local File Disclosure (2.0.5)

WordPress Plugin AccessPress Social Counter includes Backdoor [Only if downloaded via the vendor website] (1.9.1)

Severity

Medium

Classification

CVE-2019-8120 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities