CVE-2019-7909 Magento 2 Community Edition Cross-site Scripting Vulnerability
MediumCVSS 4.8
EPSS 0.56%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| magento/community-edition(Packagist) | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition(Packagist) | = 2.1.0 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.1 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.10 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.11 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.12 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.13 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.14 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.15 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.16 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.17 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.2 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.3 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.4 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.5 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.6 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.7 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.8 | No fix listed |
| magento/community-edition(Packagist) | = 2.1.9 | No fix listed |
| magento/community-edition(Packagist) | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition(Packagist) | = 2.2.0 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.1 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.2 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.3 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.4 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| magento/community-edition(Packagist) | = 2.2.5 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.6 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.7 | No fix listed |
| magento/community-edition(Packagist) | = 2.2.8 | No fix listed |
| magento/community-edition(Packagist) | >= 2.3.0, < 2.3.2 | 2.3.2 |
| magento/community-edition(Packagist) | = 2.3.0 | No fix listed |
| magento/community-edition(Packagist) | = 2.3.1 | No fix listed |
| magento | < 1.9.4.2 | 1.9.4.2 |
| magento | < 1.14.4.2 | 1.14.4.2 |
| magento | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento | >= 2.3.0, < 2.3.2 | 2.3.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com exploit
- magento.com vendor-advisory
- web.archive.org
- github.com