Description

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product.

Remediation

References

CVE-2019-8139

Related Vulnerabilities

MediaWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-44854)

PHP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5712)

WordPress Plugin PowerPress Podcasting by Blubrry Malicious Code (11.9.4)

Joomla CVE-2006-4470 Vulnerability (CVE-2006-4470)

WordPress Other Vulnerability (CVE-2006-1796)

Severity

Medium

Classification

CVE-2019-8139 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities